The holiday season is often a time of reflection, a time for organizations to look back and ask themselves 'are we doing things right'.
Judging by the continuous news stories spotlighting the latest data breach, it appears most organizations still aren't getting security right. Organizations are scared and worried about security but they are not focusing in on the areas that really matter. As we reflect upon 2014, we will look at five lessons organizations need to learn from 2014 so that they can have a better, more secure 2015.
Tis the season to be merry is a common catch phrase around the holiday, yet in reality, people often find themselves stressed and overwhelmed during this time of year. Looking back, they realize all the goals that are still unmet. The cyber security holiday season is no different. While some organizations might be happy they did not get breached this year, behind closed doors everyone, including the CEO, is likely wondering at what point a breach will happen; will it be in 2015? The answer, which no one wants to hear, is that a breach will happen. However, if handled correctly, the damage can be very minimal. Consider these lessons from 2014:
Lesson #1 – Organizations will be breached; timely detection and response are key
2014 was a year of enlightenment; people began to realize just how vulnerable organizations are and that anyone can be breached. However, much confusion remains. The issue is not that an organization was breached, rather it is the length of time that the breach went undetected and the resulting damage. If an organization is attacked but they have timely detection and control, the damage is usually not too bad. However, if a breach remains undetected for a length of time, the damage becomes increasingly worse. Therefore, the intrusion itself is not the problem, it is the lack of detection and the amount of damage that is problematic. Organizations must focus efforts on timely detection and minimizing the impact.
Lesson #2 – Allocate proper headcount
A typical knee-jerk reaction in response to the breaches we have witnessed over the past year is for organizations to spend money in the hopes of finding the silver-bullet to help them avoid falling victim to a hacker. Yet it is not a matter of spending more; it is often that they are not allocating enough head count for the security team.
In order to solve these security problems the proper resources must be allocated. Resources are not only monetary resources but also human resources to configure, monitor and maintain security devices. In many organizations there are not enough people to manage the security devices that they have. Therefore, if more security devices are purchased, an organization is actually making the problem worse by spreading their already taxed resources (people) even thinner. Organizations need to allocate proper head count to properly manage the security devices they have, before they spend more money on additional devices.