Take Critical Steps Toward Securing Your Business
Building an incident response plan starts with assuming the worst: that the technology your team is adding to its networking will, at some point, be a point of entry for a cybercriminal and will need to be shut down.
“Understand where the risk is so you can minimize it, but also so that when that event does occur, you’re prepared,” said Jeremy Weiss, cybersecurity practice lead for CDW.
When a breach takes place, Weiss told SummIT attendees, businesses must be prepared and know exactly what to do, in that moment. Many times, he said, the reality is that people don’t even know whom to call. A response plan will address that.
Beyond the playbook, teams need visibility into their own data — they need to take a step back to identify what data the business has stored, who’s accessing it and what systems it’s on. From there, the security team can make sure those systems are running both efficiently and securely.
And when it comes to adding modern devices to the network, such as Internet of Things technologies, Payton suggested that organizations should implement a fail-safe.
“These devices are trained to be turned on and be helpful to you, which means that they’re also trained to be turned on for nefarious purposes,” said Payton. “If and when you know there are issues, what’s the kill switch?”
Kill switches can be useful for organizations that witness anomalies in their network traffic, enabling them to shut down their systems to prevent the wrong person from gaining access to protected information. But while it’s a great method to help businesses mitigate risk, it can also impact on the end-user experience.
READ MORE: The 5 cybersecurity must-haves for every business.
Real Security Awareness Starts with Listening
Security is often seen as a hinderance to end users. Take multifactor authentication for example, which requires more tasks — and more time — for the user to access their device or information.
It’s really no surprise that convincing users to follow security best practices is a common challenge for security professionals. In fact, 50 percent of CDW’s Protect SummIT attendees cited this as their No. 1 cybersecurity challenge.
“The user is the most difficult thing to actually administer,” said Weiss. “But you still have to deal with users to keep your business productive.”
Payton, while stating that security awareness training is important, believes that there’s another, more effective way to reach users: active listening. She suggested that by listening to users’ problems and involving them in the decision-making process early on, they will have more respect for and interest in the security process as a whole.
“Part of their daily job is to open up an email and click on links,” Payton said. “And you think you’re going to train them on which one is good, and which one is bad? Good luck.”
She suggested asking individuals what their nightmare is if their information were to get out. Often, this prospect is so terrifying for employees that they’ll work hand in hand with the security team to stop that from happening.
“Part of it is going to be clunky, but you’ll have their buy-in,” she said, “and this is how you avoid their nightmare. Once people learn to trust you and realize you’re going to listen, they will change.”
Check out our event page for more articles and videos from the CDW Protect SummIT.
