Ask the Expert: Why is it critical that organization mature their cyber risk program now?
Kirk Hogan, CIO and Practice Lead, Security Operations at Iceberg Networks and Bill Vollono, Sales Engineer at Recorded Future sat down to discuss how the pandemic is having an effect on cyber risk programs. The following is an edited transcript of the conversation.
Kirk Hogan: It’s so important that they mature their programs now, because COVID has highlighted the fact that everyone has been sent home to work. Those that don’t physically have to be at their worksite to perform their work. That’s the majority of the world. Globally, everyone has gone home. The bad guys are looking for organizations who haven’t had time to ramp that up, so it’s so important to mature now because the bad guys are taking advantage of this window of opportunity. Unfortunately, they leave themselves exposed. Trying to pick areas where we need to protect is a tough thing to do. Bill, I don’t know if you’ve found the same thing?
Bill Vollono: I agree, definitely, but I would put another angle to it. This is a newer problem that is being highlighted, but it’s not really a new problem, it’s been around for a long time. It’s just that COVID and the pandemic has put a big spotlight on it. Like you said, are companies scaling up enough and are they maturing enough to handle the work from home office workers? Do they have firewalls? Do they have VPNs? Are they now going to be an easier target for threat actors that are leveraging credential stopping software? Open source softwares? One little step left for them to make is instead of having to target the office network, they can target a personal computer. I definitely agree with you that this has shed a light on it, but I think the bigger problem has been around for a long time.
Kirk: So I’ll give you that, I think perhaps the reason they want to [mature] now is to take advantage of this situation, unfortunately, we all find ourselves in this situation. If nothing else, maybe that spotlight has allowed the senior leadership to say, “this is the event that will drive us to action”. If it wasn’t important before, it certainly should be now. Why is it important now? Now you have the attention of your senior leadership so use that to your advantage and put in those maturity steps.
Bill: Agree completely, information security analysts and those that might be lower down on the workforce chain, they now have the luxury – if I can even use that word in the situation – to really emphasize that there’s a spotlight on the problem. It does have the CIO or the CISOs attention. I was just working with a customer recently where they were trying to validate exactly this. Help me paint the picture to my leadership of demonstrating or visualizing how threat actors have evolved to take advantage of this work from home challenge. There is definitely an opportunity that IT teams can have to demonstrate how urgent this need is and why they should be improving their programs or scaling out security controls for different attack vectors.
Kirk: So Bill, maybe to summarize, yes it’s an unfortunate situation we find ourselves in, but the timing is now and perhaps the impetus and the attention that this is getting is to the advantage of the security workforce. Use that to your advantage, take advantage of the focus you are getting from your senior leadership and get those next steps of your maturity in place.
Bill: Kirk, I would agree and the last thing I’ll say is that this is something that both large and small companies can be looking to tackle. This isn’t necessarily a big company problem. Like you said, this is affecting globally companies of all sizes, employees of all skill levels. This is an opportunity for companies across the spectrum to be looking to put in security controls and take that to their leadership.
The post Ask the Expert: Why is it critical that organization mature their cyber risk program now? appeared first on Iceberg Networks.
*** This is a Security Bloggers Network syndicated blog from Risk Intelligence Academy – Iceberg Networks authored by Meaghan O'brien. Read the original post at: https://icebergnetworks.com/ask-the-expert-why-is-it-critical-that-organization-mature-their-cyber-risk-program-now/?utm_source=rss&utm_medium=rss&utm_campaign=ask-the-expert-why-is-it-critical-that-organization-mature-their-cyber-risk-program-now
