Author: Mark Guntrip, Senior Director, Cybersecurity Strategy, Menlo Security
It wasn’t until recently that the C-suite could have long discussions surrounding technology solutions and strategies without having to give security a second thought. Today, however, that’s almost unfathomable.
Where the pandemic induced a transition to hybrid working out of necessity, operational changes were initially additive. The mindset was one of the temporary solutions to temporary challenges – employees needed frictionless computing, so companies would introduce applications and infrastructure in the interim that would ensure productivity could continue in a remote setting.
Now that we have a clearer view of where and how people will work, this approach has had to change. For hybrid and remote models to be secure and sustainable, new structures need to be developed that works for everybody – wherever they are and however they’re working – while also keeping data safe and secure.
No longer is security a case of protecting one specific network for the company, the hard-shell perimeter of the office. As well as threat actors continually evolving their methods to circumvent existing security frameworks, organizations now need to protect substantial digital asset bases and business-critical applications extending across increasingly connected global networks.
Security is a growing consideration
This changing state of play has allowed security to knock loudly on the front doors of business decision-makers. It is now a key strategic consideration. Indeed, there is little point in a company implementing a solution designed to enhance productivity if that solution undermines security and leaves firms exposed to suffering financially crippling breaches – indeed, according to IBM, the average cost of a breach in 2022 was $4.24 million.
Security teams now need to adapt and align their approaches to ensure they are considering the wider needs of the business and their colleagues. Much of this is about communicating more openly and actively, and in understandable ways, to ensure everyone is up to speed on key cyber-trends.
Protecting the enterprise needs to be the responsibility of everybody. Organizations today hold lots of information in a variety of formats, stored across different departments using different solutions. Not only is this information vital to an enterprise (intellectual property) and its customers (personal and financial data), but it often may be data belonging to third parties (customers, business partners, suppliers, etc.).
In order to mitigate this risk, it is critical that a cybersecurity workplace culture is created – where security becomes a primary consideration in all aspects of operations, part and parcel of how work is done.
Building a better understanding works both ways
CISOs need to be on the ground as much as they are in the boardroom, gaining a comprehensive understanding of potential risks that hybrid working could pose.
For example, those working from home may be leveraging networks with outdated and exploitable factory settings, and devices may not be updated in a timely fashion, preventing the patching of vulnerabilities that attackers can utilize. And shadow IT is also a problem, where staff members may be using unmanaged, unprotected devices to access sensitive data on corporate networks.
Security should be easy to embrace – if it is not, it will be ignored or, even worse, circumvented. Suppose security requires end users to jump through additional layers of red tape or suffer process changes or loss of performance in order to do their job. In that case, they will find ways to operate that work for them that remove those barriers, such as using personal devices and creating potentially invisible backdoors into the organization.
Also Read: How AI Tools Can Get Skilled at Spreading Misinformation
Understanding behaviors to reduce risk factors
Critically, CISOs must recognize that an understanding of the social, economic, and mental health impacts of workers is required in a hybrid environment to reduce social engineering risk factors. By identifying and targeting common psychological triggers and gaining the trust of the potential target, attackers are finding greater success in overcoming individuals’ natural defensive instincts.
Ensuring employees are aware that these are the sorts of tactics that can be employed is vital. Showing highly advanced spear phishing examples can be a way of instilling a more conscious mindset. Critically, as the lines begin to break down between security and the wider business, the opportunities need to be maximized in this way. By adapting security strategies to meet the needs of users and better address growing threats simultaneously, firms can ensure all employees become patrons of security – not the individuals undermining it.
For more such updates follow us on Google News ITsecuritywire News. Please subscribe to our Newsletter for more updates.
