Building Your Cybersecurity Strategy for 2017

Developing a cybersecurity strategy can give your organization the foundation and mandate to develop good policies and procedures for improving resilience. As 2016 comes to an end and we begin looking into 2017, I want to reflect and provide a few observations of strategic cybersecurity mistakes we have seen this year resulting in major losses for many organizations.

1. Focusing too much on perimeter defense. For the earliest stages of a breach, the question is no longer “if,” but “when.” Sophisticated attackers will compromise your first lines of defense, such as employee workstations, email accounts, and Internet-facing services. Although it is important to place defenses along the perimeter, you cannot neglect attention on what happens once an attacker gains access to your network. Can you prevent the attacker from moving around to more sensitive parts of your network, causing significant damage? Modern networks require more than one layer of defense to adequately protect data and computing resources.

2. Focusing too much on prevention instead of detection and response. An initial attack takes minutes. Discovery and response takes weeks or months. A recent study came out highlighting that it takes an average of 256 days for an attack to be identified. This is entirely too long. A cyber attack is not always obvious, therefore, your organization must have a strong effort to detect and respond. 

3. Focusing only on being compliant. Compliance does not ensure protection from all threats – it is just the baseline of minimum requirements. Mandatory regulations are designed to protect customer and financial data. As technology advances and your organization continues to grow, a compliance mindset puts your organization at risk. To protect your customer data, sensitive corporate data, operations and reputation, you must go beyond compliance and take an offense-oriented approach.

4. Not treating cybersecurity as a business risk. Many organizations look at cybersecurity as an IT issue. Cybersecurity is much more than an IT issue. The more connected we become, the more dangerous cyber criminals are to your organization. Using sophisticated techniques, attackers can steal not only your customer or employee information, but also your intellectual property, trade secrets, and more. Beyond that, attackers can transfer over to the physical world by gaining control of physical assets such as door locks, HVAC systems, phone systems, scanners, and more.

Make no mistake—cybersecurity is one of the biggest risks to your business today and one that needs to be taken extremely seriously from the top down. Make sure your cybersecurity strategy for 2017 is focused on the right things by learning from the mistakes made to date.

For weekly insights into enterprise complexity, please sign up here: