Cybersecurity: Seeking complex solutions to simple problems

I recently saw the movie: "The Boy Who Harnessed The Wind" on Netflix. It made me think, that solutions to complex or even existential problems could be very simple . For some of us who are in cyber security field we are quite the opposite. We tend to view cybersecurity strictly from technology viewpoint, ever searching for complex solutions and complex procedures for simple problems.

Take for example, migration to cloud. Before I took upon an in-depth study of cloud paltform, I was led to think of cloud as something very complex requiring very specialized skill sets. Frustrated with this mind-set, I decided to take on the study of Amazon Web Services (AWS) Solutions Architect. As I went through the course, I found that working in the cloud was more simpler than that in on-premise environments. A few clicks and you can have web servers and applications running. I remember spending days building web servers and making applications run on a bare-bone box which IT would hand me over. Perhaps that hands-on experience made it easy to understand the cloud. That hands-on experience taught the fundamentals and a tendency to seek simplicity even in most complex situation.

Many of the vulnerabilities listed on OWASP Top 10 have been there for many number of years. For example, Injection flaws or Cross Site Scripting. One possible explanation could be, rather than addressing the root cause, most security professionals and developers tend to focus on complex coding approach. I have designed the applications at user interactions level and the backend processing level, focusing primarily to eliminate the root cause. And that has worked. Once you address or eliminate the root cause, complex coding would simply be decoration that would enhance the robustness of the application.

Cybersecurity as Value Add to business

Compared to the past practices, every business has been adopting digital technology in how they do business. And now, companies have responded to the coronavirus pandemic by moving as many processes as possible to digital formats. However, the pandemic merely accelerated the ongoing movement of businesses transforming their business processes to a digital format which started decades ago. This process is a digital transformation, and as a result, new risks to the company arise. These new risks from digital transformation comes in the form of cyber risk.

To combat cyber risk, companies should bolster their cyber security efforts. Cybersecurity is fundamental to the digital transformation because it ensures that the new business processes are safe from malicious attacks. Furthermore, the expectation from customers is that new, digital business processes are done safely and securely. 

Cybersecurity begins with mindset, being mindful about your fiduciary responsibility towards your customers, their data, their information, their assets–all of which have been entrusted to you. Cybersecurity is not about tools and technology—tools and technology are means to achieve that mindset. Just as securing your physical property begins with accepting the need to secure them and using locks and security systems as tools and technology to meet those objectives.

Cybersecurity is not about technology but it is fundamental capability of the businesses to be adaptive and resilient to changing business processes and ever-changing threat landscape.

NIST Cybersecurity Framework to deliver on the value proposition

I have been studying the NIST Cybersecurity Framework and applying the framework to organizations. The goal is to help businesses incorporate cybersecurity into all aspects of their digital practices.

The framework is outcome driven and provides activities that the organization needs to perform to achieve those outcomes. Since the framework does not mandate how an organization must achieve those outcomes, it enables scalability.  A small organization with a low cybersecurity budget is able to approach the outcome in a way that is feasible for them.

Every business already has some host of security practices—for example, passwords on email accounts are ubiquitous. The key however is identifying the gaps between,  where they the company is now, current profile, and where it should be, aspirational - target profile. We work with businesses to develop a plan or a roadmap to achieve their target profile, to ensure that cybersecurity is an integral part of all business practices from workflow, external and internal communications and that there is a corporate culture of acceptance of cybersecurity as a value-add business proposition.

All organizations have gaps in their cybersecurity practices. The goal is to identify those gaps by creating and comparing the current profiles with target profiles and to work iteratively to narrow those gaps.

Awareness Education - employees tend to be the weakest link

The threat landscape has evolved over time. In the past,  hackers and criminals were looking for vulnerabilities in the systems–networks vulnerabilities. Hackers penetrated the system by attacking the systems. Now, they prey on people and thereby gain access to the systems. People are easier to target. Hackers first introduce malware in the system through phishing emails and gain control over the organization’s assets and then through ransomware, blackmail or extort payments. Therefore, people are the weakest link falling easy prey to phishing, spear phishing, social engineering. Awareness education drives a culture of employees becoming deterrent to cyber-attacks and thereby making organizations, cyber resilient.

Cyber Security Awareness Training

ebusinessmantra is excited to announce a new security awareness training service for our clients. Engaging employee security awareness training is an effective way to protect your organization from threats like phishing. 

Our new security awareness training solution will teach your employees how to detect and avoid malicious content through attention-grabbing training modules and realistic simulations. We have over 2000 training resources in different lengths, styles and languages to inspire a culture of security at your organization.

As your service provider, we’ll handle all aspects of employee training — including implementation, management and reporting. This helps you: 

• Prevent data breaches and other security incidents.
• Meet and track security awareness compliance requirements.
• Save time and money with automated course delivery, management, and reporting.