Your Security Questions Answered
Top three questions every business and IT leader ask themselves
Security is very much in the news, with a catastrophic attack on the Irish Health Service with an estimated £100m cost of remediation and significant disruption to patients. Dan Cooper, Security Consultant at CyberLab, answers three key questions every small to medium-sized business asks themselves about protecting their data:
- Has security really changed that much in the past few years?
- Am I using the best-in-class security vendors today?
- Do I have the right skills and time in-house to manage these solutions?
I think it safe to say that organisations of all shapes and sizes have now well and truly began their journey to the cloud. Some were already transitioning to the new concept of modern working, while the pandemic drove change in others. However, adopting a secure remote working model is top of mind for everyone, or at least it should be.
One of the key challenges to adopting a secure remote workforce is the ever-growing responsibilities of the IT teams. They are now required to protect information and secure networks while doing their ‘day job’ of maintaining the systems. This jack-of-all-trades scenario is a common theme when discussing business strategy with our customers.
From our experience, security remains a secondary priority for the vast majority of small to medium-sized businesses. Despite the constantly increasing risks and the ever-growing focus on cybersecurity in general, it makes sense to focus on keeping the company operating. We understand that without the primary systems, it’s unlikely your organisation would be able to trade and make money.
So how do you then ensure that you spend the right amount of time, money, and resources on securing and maintaining your systems? How do you know that you have a good security posture? And if you do decide to invest time, where do you start? How do you ensure what you are doing is the correct or best way of achieving a good security standard?
You may be asking yourself ‘Has security really changed that much in the past few years?‘
Without any doubt, yes!
Firstly, cyber risk is not confined to the four walls of an organisation anymore. It is now standard practice for employees to be working remotely from both company-issued and personally owned devices. Technological advances have made businesses more productive, more efficient, and more cost-effective, but they have also potentially made them more vulnerable. It has made protection that much harder as people will be accessing applications and corporate data that reside in the cloud.
Secondly, the traditional approach to cybersecurity involved simply adding a new point product to address each new threat. However, as the attack surface continues to expand, so does the number of solutions on the market. In some cases, this creates a ‘patchwork quilt’ of products that do not necessarily work together. Even as companies add more security tools, the breaches continue, making this strategy unsustainable.
Another question many IT leaders face is ‘Am I using the best-in-class security vendors today?‘
Given the rapid change in work styles and the lucrative cybercrime world we now live in, it’s apparent that some of the more traditional security vendors have struggled to keep pace.
We recently noticed a new wave of best in class security vendors starting to lead the charge. Take Microsoft, for example, which are investing significantly in this area, or Sophos, who built their synchronised security model across endpoints and firewalls. Gartner and Forester both recognise them as the new market leaders across security.
We know that keeping pace with the vendors is a daunting task – knowing which is best to use in your case or adopting new technology into an organisation without increasing vulnerabilities. Even when you think you have finally figured out the winning mix and you have all the advanced, leading security products in place, you face the challenge of who’s looking after it?
You should also always ask yourself ‘Do I have the right skills and time in-house to manage these solutions?‘
We often see misconfigurations causing an incident. This can happen to both rookie engineers or those with years of experience under their belt. You can burn out one evening from completing an application upgrade while rolling out laptops. You can misconfigure a firewall. You can forget to deploy antivirus or multifactor authentication for the new starters. You may not pick up a vulnerability in time before a malicious actor takes advantage of the accidental weakness.
Furthermore, you may need to complete a dreaded information security questionnaire or to achieve Cyber Essentials certification as soon as possible to win a contract. I previously worked in IT support in a highly regulated industry, wearing ‘many hats’. I know first-hand how difficult this task can be. When we looked at revisiting our managed security services, we ensured that we didn’t forget the knowledge, process and configuration management aspects. No matter how good the security product is, human error will always be the weak link – who is looking after it and how.
Partnering with a managed service provider demonstrates to your customers, partners, and suppliers that you take security seriously. Having a dedicated team of security engineers involved in looking after your estate and helping you with daily duties is invaluable. If you are unsure about where to start or what your next step should be on the journey, our consultative approach ensures we get to know your business and help you adopt the right security.
Security Support
Control Costs, Maximise Value, Improve Security
Cyber security can be confusing, complicated, and incredibly stressful. We’re here to take the uncertainty away from your cyber defences.
Security Support from CyberLab allows you to maintain control over your systems and programs, but with the peace of mind that you have an expert on hand whenever you need, all without hiring any more people.
CyberLab Brand Launch
Leave a Reply
You must be logged in to post a comment.