Cybersecurity is a Successfully Failure
Next-generation firewalls are well, XDRing, IPS in prevention mode, and we had 100% attainment of our security awareness weekly training podcast. Yes, we even have email encryption of all outbound messages with complete data loss prevention enabled with multi-factor authentication! Hold on, didn’t we just deploy CASB for DLP?
How did ransomware propagate across several VLANs protected with micro-segmentation and isolation?
Something failed! Or Did it?
Failure is defined as something that was supposed to work but didn’t. Something must have gone wrong with one of the hundred adaptive controls, security policies, and the eleven MSSPs we have hired to cover the twenty cloud-based applications linking back to our centralized Zero-trust running inside a SASE cloud remote access for people working on-premise.
What Could Go Wrong? Everything or Nothing.
Cybersecurity has become a react, overreact, and under-react process, not a solution or strategy. With over 1000 plus vendors going to great lengths to show their greatest over their competitors, the consuming enterprise CISO and CIO will continue to breach, data exfiltration, and ransomware.
With each new layer of adaptive security control, there is supposed to be a layer of new and improved protection and new attack surfaces. Why would you suspect these devices to fail if an organization enabled a CASB solution or 5G radio antennas for better security? Did they provide a unique business value at the cost of increased cybersecurity risk and cost?
Why CyberSecurity Belongs At the Board of Directors?
Cybersecurity will continue to be a successful failure until organizations realize that without a genuine, fully integrated, non-political, non-bias approach to protecting the organization and its people, assets, and data first before they venture down the digital transformation apocalypse, they will continue to fail.
Business relies on customers. Consumers do business with people they trust. If the consumer loses faith in the company, they will speak less of your organization and choose to spend their dollars elsewhere.
Even when you just spent millions based on your “trusted advisors” recommending all this “stuff” for your SOC2 compliance, CMMC level3, HIPAA, NIST-800–53, and PCI.
How to Live With Being a Successful Failure in Cyber?
The first important thing to remember, once Cybersecurity becomes a threat to the organization, and you choose to implement “check the box” technology from your trusted vendors, you have already lost. Second, the most important thing to remember is don’t repeat what you just did; learn from it.
Getting ahead on cybersecurity starts with the business recognizing that cybersecurity is integrated into the trust culture of the company. Every decision has cybersecurity protection in the DNA. Acquiring companies, hiring contractors, leveraging open source to save money (we will save that for another blog), and, my favorite, always doing business with the same VARs. A “trusted advisor” should have nothing to do with products or services. They only tell you how to protect your organization by increasing the success of cybersecurity protection by reducing the failures that will happen.
Trust is a 360-degree circle; Cybersecurity should be the same.
All the best,
John
