Insight: Eight steps companies can take to become breach proof

Tim Bandos, Senior Director of Cybersecurity at Digital Guardian, identifies eight key components of a robust cyber security framework and discusses why a strategic approach must be taken if long-term cultural change is to be achieved.

An effective organisational security framework is an absolute necessity in today’s business environment, but all too often companies are falling short, either through poor/rushed planning or failure to strike the right balance between technology and employee education.

The answer lies in blending strategic security technology investments with regular employee training and awareness to create a comprehensive security net without compromising business productivity. This can be tricky without the right tools and knowledge, but below are eight key steps to follow when aiming to combine the best of both worlds:

Invest in the right security technology
In the current security climate, relying on employees to do the right thing in every situation is both unfair and unrealistic. Whilst overly restrictive or heavy handed security practices can hinder productivity, the right technology investments made in the right areas will have an overwhelmingly positive impact. Not only will it take the guesswork out of many security situations, but creating a technology based safety net will relieve pressure on employees, allowing them to go about their jobs without fear of recrimination.

See also:

• Telecom Italia agrees Microsoft partnership to drive AI integration
• BASF reveals employee ideas saved it €58mn in 2017
• Business Chief magazine, Europe edition - click here to read April's issue

Beware the insider threat
Not all employees are created equal when it comes to risk. It’s important to take the time to identify which employees, at every level of the business, represent the greatest risk to sensitive business data in the event of a security breach. For example, employees with network administrator credentials pose a far higher risk than those with local user access. Other employees may be the custodians of critical business IP, making them more of a target to cyber criminals. Determining where the most risk resides and tailoring defences accordingly is one of the highest priorities for any business looking to improve its cyber security.

Reward good behaviour
Simply communicating security policy to employees and expecting them to adhere to it immediately is unlikely to work. Changing employee behaviour requires regular training as well as positive reinforcement. Incentivising employees to follow established protocols and rewarding those that do will go long way to enacting long-term behavioural change by helping them to form new habits that become instinctive over time. 

Don’t limit security to the IT department
Too many businesses place the burden of security solely at the feet of the IT department. In reality, a robust security framework requires buy-in from nearly every department if it is to be successful. The marketing department can even play a role in building a strong security brand within the company. Tapping into a group of individuals that knows how to position oneself, what reaches people, and how to measure it, can be enormously helpful with internal awareness.

Consider appointing internal security leaders
Depending on the size of a business it can also be helpful to appoint a group of internal leaders to further assist with security efforts. A group of knowledgeable individuals can streamline communications across the business, bring security issues to the table in a constructive manner and help to field security questions from employees in order to improve decision making and cut down on trivial mistakes.

Policies, policies, policies
All effective security frameworks need to be underpinned by a clear written policy. Without a policy in place, it can sometimes be difficult to hold employees accountable for their actions. Creating a written policy immediately solves this issue whilst providing an initial reference point for anyone wishing to clarify company position on anything relating to cyber security.

Don’t reinvent the wheel
When it comes to IT security management frameworks, there are already numerous great guides out there. Not everything will be relevant to every business, but aligning with industry best practices will always create an excellent platform from which to move forward. Furthermore, the end result will likely be a far more comprehensive security framework than would otherwise be the case. 

Know good things take time
It can sometimes take years for a company to deploy a successful security awareness campaign, let alone master organisational security over the long-term. Too many businesses try to be tactical in their approach when what’s really needed is a long term strategic vision that’s built up over time. Focus on timelines of years, not weeks or months, and the chances of success will be much higher.

Achieving a robust cyber security framework can often feel like an uphill struggle, but all too often businesses are making fundamental mistakes that significantly hamper their efforts. Adhering to a series of logical steps such as those above will not only help businesses ensure they are covering all important aspects of cyber security, but that their efforts will enable long-term cultural change rather than resulting in a short-term fix that is soon forgotten again.