Page 3 of 2

Six Updates Companies Need to Make to Modernize Their Cybersecurity

• Apr 17, 2019

Having an up-to-date cybersecurity plan is crucial for enterprises that want to stay as protected as possible from the latest threats in the online realm. Here are six things you can do to be proactive against potential issues.

1. Make Employees' Cybersecurity Training Ongoing

In the case of many kinds of workplace training, people learn about the topic once a year at most. Then, they quickly forget the learned material after the training event and have few or no opportunities to apply it in real life. When that happens with cybersecurity, employees are not adequately equipped to play their roles in helping safeguard against threats.

A study of businesses in the United Kingdom found that only 46 percent of polled organizations provided cybersecurity awareness training beyond new hire onboarding or annual refresher courses. If employees receive regular updates about cybersecurity issues affecting the company, they'll know how to spot risks and not fall for things like phishing attempts.

2. Incorporate More Frequent Board-Level Cybersecurity Discussions

Ideally, a cybersecurity plan must take a top-down approach where the people at the highest levels of a company, as well as the board of directors, are aware of the most pressing threats and their mitigation efforts. However, most of the time, that doesn't happen.

Research from McKinsey showed that only a quarter of companies present cybersecurity matters to the board of directors more than once a year. Moreover, up to 35 percent of companies only give that information to the board on request. Any cybersecurity plan should implement regular cybersecurity discussions with the board, such as every month.

If a company has cybersecurity-related checks they make on a daily, weekly and monthly basis, representatives from that organization should add board discussions to the monthly checklist.

Board members don't need to become cybersecurity experts. But they must know what's happening from a cybersecurity standpoint and how potential attacks could negatively impact the organization. Then, they can make smart decisions about the company's future competitiveness in the marketplace and avoid pitfalls.

3. Set Security Policies That Relate to the Information Each Employee Needs

Many companies are far too lenient when it comes to employee access to sensitive documents. Sometimes they don't have any access-related security policies in place at all, which increases the risk of information mismanagement and the potential breach of client confidentiality.

The 2018 Data Risk Report from Varonis revealed that 88 percent of companies with at least 1 million folders of data had more than 100,000 of them open to everyone. Additionally, in 21 percent of cases, all employees had access to every folder owned by the company.

On the other end of the spectrum, an employee could quickly get frustrated if they regularly need to access documents requiring login information they don't have. A company should update its cybersecurity plan by using a security policy manager to establish, adjust or remove individual security policies for the documents that employees use.

This approach works well when a company scales up and may need to let remote teams access certain folders to do their work off-site, for example. Companies may decide that the easiest thing to do is let most employees have access to most or all files, which is not a smart move when it comes to cybersecurity.

4. Download Operating System Updates on All Applicable Devices

When creating or updating their cybersecurity plans, many companies examine their networks but don't pay enough attention to the devices connected to them. Doing a device-level assessment of risks is especially essential, since many people bring their own devices to work or use personal devices outside of work hours to access sensitive files from home.

A market share report spanning from April 2018 to March 2019 showed that Windows 7 still edged out Windows 10 for the top operating system. However, outdated operating systems increase the overall vulnerability to threats. The situation is even worse if people don't install security patches associated with known issues on those older operating systems.

A substantial part of a company's cybersecurity plan should encompass updating all the operating systems on company computers — including personal devices that people bring from home. Otherwise, a company could be more prone to threats than it seems on the surface.

5. Make an Incident Response Plan That's Specific to Your Organization

It's not sufficient for companies to come up with a cookie-cutter approach to responding to cybersecurity problems. A team of researchers recently worked on creating a better incident response framework for cybersecurity incidents. They looked at weaknesses within organizations and discovered that one of the common flaws was that companies created generic response plans.

The researchers caution that it's preferable to plan for incidents in ways that are specific to the company. That includes having a clear, actionable list of steps to take after an incident. Furthermore, all people in the organization must have access to that plan and know how to act on it — not just the IT department or cybersecurity team.

6. Prioritize Cybersecurity Hiring or Upskilling

There is a global cybersecurity skills gap of nearly 3 million positions. This issue makes it incredibly difficult for companies to find enough cybersecurity talent. However, you should still emphasize talent management as part of your updated cybersecurity process.

If a look at your previous cybersecurity plan shows you don't have enough staff members to keep up with demand, consider upskilling people in other IT roles by signing them up for cybersecurity boot camps or online certificate courses.

Having a relevant and current cybersecurity plan is one necessity, of course. But the cybersecurity professionals responsible for carrying it out also need to thoroughly understand the most likely threats a company may experience. That can't happen if you treat cybersecurity as an afterthought.

Updated Plans Increase Protection

These items show that numerous factors can render your IT plan outdated. Fortunately, it's easy to fix them and make smarter decisions moving forward. Doing that helps organizations avoid costly cybersecurity issues.