It is Time to Think about Cyber Awareness
- By Chris Strand
- Oct 20, 2022
Cyber Awareness Month is upon us and we want to share some of our best practices for what organizations can do to enhance their security posture while remaining vigilant to stay ahead of threats as best they can. With the shortage of skills and talent needed to keep up, businesses are at great risk of a breach, which can amount to losses in the millions of dollars.
It is a good reminder to note that cybercriminals often have the advantage as they are highly motivated and not bound by the many required compliance and regulatory mandates. In the fight against cybercriminals, threat intelligence can be a useful ally, enriching the process of audit and assessment, and providing proof of security controls enforcement that is required for security and compliance.
For the best protection given limited resources, read these recommendations and step that businesses can take to improve cyber security. Consider these critical steps.
- Prioritize vulnerabilities beyond what is offered by the Critical Vulnerability Scoring System (CVSS), which is often slow to score threats and only measures the estimated severity – but not risk – of exploitation.
- Keep up with ongoing changes in data privacy legislation, which can be burdensome and overwhelming, yet is of utmost importance in ensuring security measures are continually updated
- Monitor threat activity on the Dark Web to understand how cyberattacks are performed, and to know if your business systems are targeted. Also, know which attack tools are for sale and purchased, as well as the success rates of current cybersecurity campaigns.
Proactive vulnerability and gap analysis is key in helping companies meet the reduced timeframes for notification of a breach. Accelerated prioritization of security gaps can play a major role in helping to identify potential security incidents faster, or they can help identify a targeted attack before it takes place. Many cybersecurity regulations and compliance standards now also include vulnerability prioritization in their requirements.
The easiest way to achieve and fulfill the vulnerability prioritization requirement is by proactively understand enterprise assets to the point where security hot spots - or gaps - are revealed at a faster rate. If that awareness can be driven by the need to demonstrate alignment with a 36-hour breach-reporting window, then it can have a positive effect on driving the needed change across the market.
About the Author
Chris Strand is the chief risk and compliance officer at Cybersixgill.