Six Updates Companies Need to Make to Modernize Their Cybersecurity

Six Updates Companies Need to Make to Modernize Their Cybersecurity

Six things you can do to be proactive against potential cyber crimes.

Having an up-to-date cybersecurity plan is crucial for enterprises that want to stay as protected as possible from the latest threats in the online realm. Here are six things you can do to be proactive against potential issues.

1. Make Employees' Cybersecurity Training Ongoing

In the case of many kinds of workplace training, people learn about the topic once a year at most. Then, they quickly forget the learned material after the training event and have few or no opportunities to apply it in real life. When that happens with cybersecurity, employees are not adequately equipped to play their roles in helping safeguard against threats.

A study of businesses in the United Kingdom found that only 46 percent of polled organizations provided cybersecurity awareness training beyond new hire onboarding or annual refresher courses. If employees receive regular updates about cybersecurity issues affecting the company, they'll know how to spot risks and not fall for things like phishing attempts.

2. Incorporate More Frequent Board-Level Cybersecurity Discussions

Ideally, a cybersecurity plan must take a top-down approach where the people at the highest levels of a company, as well as the board of directors, are aware of the most pressing threats and their mitigation efforts. However, most of the time, that doesn't happen.

Research from McKinsey showed that only a quarter of companies present cybersecurity matters to the board of directors more than once a year. Moreover, up to 35 percent of companies only give that information to the board on request. Any cybersecurity plan should implement regular cybersecurity discussions with the board, such as every month.

If a company has cybersecurity-related checks they make on a daily, weekly and monthly basis, representatives from that organization should add board discussions to the monthly checklist.

Board members don't need to become cybersecurity experts. But they must know what's happening from a cybersecurity standpoint and how potential attacks could negatively impact the organization. Then, they can make smart decisions about the company's future competitiveness in the marketplace and avoid pitfalls.

3. Set Security Policies That Relate to the Information Each Employee Needs

Many companies are far too lenient when it comes to employee access to sensitive documents. Sometimes they don't have any access-related security policies in place at all, which increases the risk of information mismanagement and the potential breach of client confidentiality.

The 2018 Data Risk Report from Varonis revealed that 88 percent of companies with at least 1 million folders of data had more than 100,000 of them open to everyone. Additionally, in 21 percent of cases, all employees had access to every folder owned by the company.

On the other end of the spectrum, an employee could quickly get frustrated if they regularly need to access documents requiring login information they don't have. A company should update its cybersecurity plan by using a security policy manager to establish, adjust or remove individual security policies for the documents that employees use.

This approach works well when a company scales up and may need to let remote teams access certain folders to do their work off-site, for example. Companies may decide that the easiest thing to do is let most employees have access to most or all files, which is not a smart move when it comes to cybersecurity.

4. Download Operating System Updates on All Applicable Devices

When creating or updating their cybersecurity plans, many companies examine their networks but don't pay enough attention to the devices connected to them. Doing a device-level assessment of risks is especially essential, since many people bring their own devices to work or use personal devices outside of work hours to access sensitive files from home.

A market share report spanning from April 2018 to March 2019 showed that Windows 7 still edged out Windows 10 for the top operating system. However, outdated operating systems increase the overall vulnerability to threats. The situation is even worse if people don't install security patches associated with known issues on those older operating systems.

A substantial part of a company's cybersecurity plan should encompass updating all the operating systems on company computers — including personal devices that people bring from home. Otherwise, a company could be more prone to threats than it seems on the surface.

5. Make an Incident Response Plan That's Specific to Your Organization

It's not sufficient for companies to come up with a cookie-cutter approach to responding to cybersecurity problems. A team of researchers recently worked on creating a better incident response framework for cybersecurity incidents. They looked at weaknesses within organizations and discovered that one of the common flaws was that companies created generic response plans.

The researchers caution that it's preferable to plan for incidents in ways that are specific to the company. That includes having a clear, actionable list of steps to take after an incident. Furthermore, all people in the organization must have access to that plan and know how to act on it — not just the IT department or cybersecurity team.

6. Prioritize Cybersecurity Hiring or Upskilling

There is a global cybersecurity skills gap of nearly 3 million positions. This issue makes it incredibly difficult for companies to find enough cybersecurity talent. However, you should still emphasize talent management as part of your updated cybersecurity process.

If a look at your previous cybersecurity plan shows you don't have enough staff members to keep up with demand, consider upskilling people in other IT roles by signing them up for cybersecurity boot camps or online certificate courses.

Having a relevant and current cybersecurity plan is one necessity, of course. But the cybersecurity professionals responsible for carrying it out also need to thoroughly understand the most likely threats a company may experience. That can't happen if you treat cybersecurity as an afterthought.

Updated Plans Increase Protection

These items show that numerous factors can render your IT plan outdated. Fortunately, it's easy to fix them and make smarter decisions moving forward. Doing that helps organizations avoid costly cybersecurity issues.

Featured

  • Securing the Future

    Two security experts sit down with Security Today’s editor in chief Ralph C. Jensen to discuss what they see emerging and changing over the next several years along with how security stakeholders can harness these innovations into opportunities. Read Now

  • Collaboration Made Easy Using a Work Management Platform

    Effective collaboration between security operators, teams and other departments is critical to the smooth functioning of organizations. Yet, as organizations grow in complexity, it becomes more difficult for teams to coordinate with each other. This is compounded by staffing shortages, turnover and ineffective collaboration tools. Read Now

  • Creating a Safer World

    Managing and supporting locks and door hardware within a facility is a big responsibility. A building’s security needs to change over time as occupancy and use demands evolve, which can make it even more challenging. Read Now

  • Creating More Versatility

    Today, AI has become top of mind for most security professionals. It is the topic of conversation in the technology world and continues to transform the way data is used to make important business decisions. Read Now

New Products

  • Hanwha QNO-7012R

    Hanwha QNO-7012R

    The Q Series cameras are equipped with an Open Platform chipset for easy and seamless integration with third-party systems and solutions, and analog video output (CVBS) support for easy camera positioning during installation. A suite of on-board intelligent video analytics covers tampering, directional/virtual line detection, defocus detection, enter/exit, and motion detection.

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance.