Six Updates Companies Need to Make to Modernize Their Cybersecurity

Six Updates Companies Need to Make to Modernize Their Cybersecurity

Six things you can do to be proactive against potential cyber crimes.

Having an up-to-date cybersecurity plan is crucial for enterprises that want to stay as protected as possible from the latest threats in the online realm. Here are six things you can do to be proactive against potential issues.

1. Make Employees' Cybersecurity Training Ongoing

In the case of many kinds of workplace training, people learn about the topic once a year at most. Then, they quickly forget the learned material after the training event and have few or no opportunities to apply it in real life. When that happens with cybersecurity, employees are not adequately equipped to play their roles in helping safeguard against threats.

A study of businesses in the United Kingdom found that only 46 percent of polled organizations provided cybersecurity awareness training beyond new hire onboarding or annual refresher courses. If employees receive regular updates about cybersecurity issues affecting the company, they'll know how to spot risks and not fall for things like phishing attempts.

2. Incorporate More Frequent Board-Level Cybersecurity Discussions

Ideally, a cybersecurity plan must take a top-down approach where the people at the highest levels of a company, as well as the board of directors, are aware of the most pressing threats and their mitigation efforts. However, most of the time, that doesn't happen.

Research from McKinsey showed that only a quarter of companies present cybersecurity matters to the board of directors more than once a year. Moreover, up to 35 percent of companies only give that information to the board on request. Any cybersecurity plan should implement regular cybersecurity discussions with the board, such as every month.

If a company has cybersecurity-related checks they make on a daily, weekly and monthly basis, representatives from that organization should add board discussions to the monthly checklist.

Board members don't need to become cybersecurity experts. But they must know what's happening from a cybersecurity standpoint and how potential attacks could negatively impact the organization. Then, they can make smart decisions about the company's future competitiveness in the marketplace and avoid pitfalls.

3. Set Security Policies That Relate to the Information Each Employee Needs

Many companies are far too lenient when it comes to employee access to sensitive documents. Sometimes they don't have any access-related security policies in place at all, which increases the risk of information mismanagement and the potential breach of client confidentiality.

The 2018 Data Risk Report from Varonis revealed that 88 percent of companies with at least 1 million folders of data had more than 100,000 of them open to everyone. Additionally, in 21 percent of cases, all employees had access to every folder owned by the company.

On the other end of the spectrum, an employee could quickly get frustrated if they regularly need to access documents requiring login information they don't have. A company should update its cybersecurity plan by using a security policy manager to establish, adjust or remove individual security policies for the documents that employees use.

This approach works well when a company scales up and may need to let remote teams access certain folders to do their work off-site, for example. Companies may decide that the easiest thing to do is let most employees have access to most or all files, which is not a smart move when it comes to cybersecurity.

4. Download Operating System Updates on All Applicable Devices

When creating or updating their cybersecurity plans, many companies examine their networks but don't pay enough attention to the devices connected to them. Doing a device-level assessment of risks is especially essential, since many people bring their own devices to work or use personal devices outside of work hours to access sensitive files from home.

A market share report spanning from April 2018 to March 2019 showed that Windows 7 still edged out Windows 10 for the top operating system. However, outdated operating systems increase the overall vulnerability to threats. The situation is even worse if people don't install security patches associated with known issues on those older operating systems.

A substantial part of a company's cybersecurity plan should encompass updating all the operating systems on company computers — including personal devices that people bring from home. Otherwise, a company could be more prone to threats than it seems on the surface.

5. Make an Incident Response Plan That's Specific to Your Organization

It's not sufficient for companies to come up with a cookie-cutter approach to responding to cybersecurity problems. A team of researchers recently worked on creating a better incident response framework for cybersecurity incidents. They looked at weaknesses within organizations and discovered that one of the common flaws was that companies created generic response plans.

The researchers caution that it's preferable to plan for incidents in ways that are specific to the company. That includes having a clear, actionable list of steps to take after an incident. Furthermore, all people in the organization must have access to that plan and know how to act on it — not just the IT department or cybersecurity team.

6. Prioritize Cybersecurity Hiring or Upskilling

There is a global cybersecurity skills gap of nearly 3 million positions. This issue makes it incredibly difficult for companies to find enough cybersecurity talent. However, you should still emphasize talent management as part of your updated cybersecurity process.

If a look at your previous cybersecurity plan shows you don't have enough staff members to keep up with demand, consider upskilling people in other IT roles by signing them up for cybersecurity boot camps or online certificate courses.

Having a relevant and current cybersecurity plan is one necessity, of course. But the cybersecurity professionals responsible for carrying it out also need to thoroughly understand the most likely threats a company may experience. That can't happen if you treat cybersecurity as an afterthought.

Updated Plans Increase Protection

These items show that numerous factors can render your IT plan outdated. Fortunately, it's easy to fix them and make smarter decisions moving forward. Doing that helps organizations avoid costly cybersecurity issues.

Featured

  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity

Webinars

New Products

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3