How Much Cybersecurity Is Enough?

Cybersecurity investments can be infinite: Here’s how to find your floor.

You can make unlimited investments in cybersecurity and still never achieve that nirvana of being “totally secure.” At the same time, service interruptions or losing customer data are so detrimental to your company’s reputational trust and financial bottom line that security is paramount. So, just how much time, effort, and money should your organization invest to ensure it’s secure?

Because cybersecurity perfection is elusive, it’s important to first determine your floor–the minimum amount of security your organization needs to meet your base-level requirements. These should include:

• Recoverability of data and systems should a catastrophic breach occur
• Meeting foundational security best practices for current threats, such as employing multi-factor authentication (MFA), deep packet inspection, lateral movement defenses, stringent password hygiene, and security operations center services/endpoint detection and response tools
• Adequate security to meet ethical responsibilities (and be able to demonstrate due diligence in) protecting organizational/customer data
• Meeting all regulatory requirements around data protection and privacy, pertaining to your specific industry and organization

Recoverability: The importance of backups

In our experience, few companies understand that backups are one of the most important security controls for an organization’s future. All breaches end with data exfiltration, backup/mass destruction, or both. To disrupt the breach pattern, organizations must first assume it is impossible to prevent all breaches. Threat actors target backups for encryption or destruction 93 percent of the time in attacks like ransomware, so it’s essential to ensure you can recover without resorting to paying ransoms (because even ransom payments don’t guarantee recovery).

Prioritize having stringent controls within and around your backups while also ensuring that threat actors cannot move laterally in your network to access, damage, or destroy these data stores. Also take great care that these safeguards are well-orchestrated, secure, resilient, redundant, and complete, which protects against the risk of total loss. Backups must also be “immutable,” meaning incapable of being changed, deleted, or moved outside of set retention policies or strict access procedures.

Protect sensitive data and meet regulations

Every company has–at a minimum–an ethical obligation to protect the data they hold in trust about their employees, customers, partners, and operations. Law firms must protect their clients’ private and sensitive legal case information; healthcare organizations must maintain patient data privacy; critical infrastructure and government entities are the custodians of highly sensitive data, the loss of which can have serious consequences for people’s lives and national defense.

Most industries also have a varying number of legal obligations to protect data. Regulatory frameworks like HIPAA, GDPR, FedRAMP, and others outline standards that applicable companies must meet to ensure data security and privacy. The cybersecurity rules adopted in July 2023 by the SEC further mandate additional governance, policy, and process requirements for publicly traded companies, holding C-level officers accountable. Your organization should meet applicable requirements and be able to demonstrate due diligence against ethical goals and frameworks.

Insurance carriers and clients may also dictate minimum security requirements.

How can you meet your minimum requirements?

The key to security efficiency is understanding how breaches progress, including tactics and patterns (“breach context”), and then working to disrupt the breach context with highly prioritized investments and efforts.

There is a pattern to breach progression: The attacker compromises credentials; creates persistent network access; elevates access; and then moves laterally in the environment to execute malicious acts (including exfiltrating data, encrypting, and/or destroying backups).

Effective security requires moving backwards in the chain. First, ensure that your backups are impenetrable and recoverable. Next, secure systems so that lateral movement is impossible (by rigorous application of MFA on all administrative controls). Then, focus on locking down credentials and endpoint access (and so on).

To keep this process scalable, it is important to do all these tasks with full knowledge of the tactics, techniques, and procedures of today’s threat actors–how they are compromising organizations today in real-world breaches–so you can prioritize your efforts and focus your dollars. Security frameworks like NIST and many organizational security programs are too blind to current threat patterns, tactics, and methods to be effective. By focusing on defending against in-use threat tactics and patterns, companies can hone their efforts. It’s equally important to only buy tools and solutions you or a third-party team have the skills and breadth to fully utilize, rather than purchasing expensive and complicated tools that sit idle or underutilized.

Achieve a security program that’s just the right size

Most people in IT and security understand you can’t create perfect security. But with knowledge of threat actor tactics, as they change daily, IT teams can disrupt the breach pattern at every stage and achieve relevant, timely defenses where they are the most vulnerable. While access to real-time threat actor data can be challenging, some managed security services providers can help. Coupled with a solid focus on meeting regulations for your specific industry, you can arrive at a right-sized, focused security program.

Contact our team of experts to learn more about developing a comprehensive cybersecurity training program for your business.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from Inc.com SOURCE