Feb 13 2020

How to Mitigate Cyber-Risk While Empowering a Modern Workforce

For security professionals, achieving a balance between end-user ease of use and robust enterprise security starts with strategy.

Resiliency is often something that businesses lack when a cyber event occurs. To combat this, businesses need to develop enduring security strategies around the technologies they currently have in place or plan to deploy.

So argued leading cybersecurity expert Theresa Payton, the president and CEO of Fortalice Solutions, speaking at the CDW Protect SummIT in San Antonio. Payton also served as the first female CIO at the White House and is the co-founder of Dark Cubed, a technology startup providing Cybersecurity Software as a Service.

“I’m not telling you to not integrate newer technologies, such as cloud or AI,” said Payton. “You have to. It’s the only way to cut costs and stay competitive.”

However, she explained that as businesses implement such solutions, security teams need to develop an incident response playbook, including user controls or authorizations and a “kill switch.” She also stressed the importance of getting buy-in from various stakeholders within the organization, particularly end users.

Take Critical Steps Toward Securing Your Business

Building an incident response plan starts with assuming the worst: that the technology your team is adding to its networking will, at some point, be a point of entry for a cybercriminal and will need to be shut down.

“Understand where the risk is so you can minimize it, but also so that when that event does occur, you’re prepared,” said Jeremy Weiss, cybersecurity practice lead for CDW.

When a breach takes place, Weiss told SummIT attendees, businesses must be prepared and know exactly what to do, in that moment. Many times, he said, the reality is that people don’t even know whom to call. A response plan will address that.

Beyond the playbook, teams need visibility into their own data — they need to take a step back to identify what data the business has stored, who’s accessing it and what systems it’s on. From there, the security team can make sure those systems are running both efficiently and securely.

And when it comes to adding modern devices to the network, such as Internet of Things technologies, Payton suggested that organizations should implement a fail-safe.

“These devices are trained to be turned on and be helpful to you, which means that they’re also trained to be turned on for nefarious purposes,” said Payton. “If and when you know there are issues, what’s the kill switch?”

Kill switches can be useful for organizations that witness anomalies in their network traffic, enabling them to shut down their systems to prevent the wrong person from gaining access to protected information. But while it’s a great method to help businesses mitigate risk, it can also impact on the end-user experience.

READ MORE: The 5 cybersecurity must-haves for every business.

Real Security Awareness Starts with Listening

Security is often seen as a hinderance to end users. Take multifactor authentication for example, which requires more tasks — and more time — for the user to access their device or information.

It’s really no surprise that convincing users to follow security best practices is a common challenge for security professionals. In fact, 50 percent of CDW’s Protect SummIT attendees cited this as their No. 1 cybersecurity challenge.

“The user is the most difficult thing to actually administer,” said Weiss. “But you still have to deal with users to keep your business productive.”

Payton, while stating that security awareness training is important, believes that there’s another, more effective way to reach users: active listening. She suggested that by listening to users’ problems and involving them in the decision-making process early on, they will have more respect for and interest in the security process as a whole. 

“Part of their daily job is to open up an email and click on links,” Payton said. “And you think you’re going to train them on which one is good, and which one is bad? Good luck.”

She suggested asking individuals what their nightmare is if their information were to get out. Often, this prospect is so terrifying for employees that they’ll work hand in hand with the security team to stop that from happening.

“Part of it is going to be clunky, but you’ll have their buy-in,” she said, “and this is how you avoid their nightmare. Once people learn to trust you and realize you’re going to listen, they will change.”

Check out our event page for more articles and videos from the CDW Protect SummIT.

Peopleimages/Getty Images

Learn from Your Peers

What can you glean about security from other IT pros? Check out new CDW research and insight from our experts.