How to Keep the Bad Guys OUT: Cyber Security Best Practices

September 02, 2019

by Lauren Cahn

Innovation benefits not only businesses but also bad actors. As digital transformation becomes increasingly ubiquitous, more data becomes vulnerable to attack from more points of vulnerability and from more potential attack vectors. In the last year alone¹:

Web attacks are up by 56% (e.g., breaches introduced from a third party website)
Supply chain attacks are up by 78% (e.g., breaches introduced through/by vendors and third party service providers)
Attacks that come from email attachments that are actually office files are up 43%

To minimize the risk of a data breach, businesses need to be as innovative in their approach to security as they are in their approach to digital transformation. Just as digital transformation requires an overarching enterprise-wide strategy, so too does security transformation, including securing the right digital transformation team, the right security team, and ensuring appropriate checks and balances between them. All of that requires much of what an effective digital transformation requires, not the least of which involves embedding the “culture” into the enterprise through:

stakeholder buy-in
necessary capital investment
some level of organizational fluidity

Based on our own experience as a digital transformation partner to over 4,000 businesses across the globe, as well as our constant monitoring of the digital and security transformation landscape, we’ve come up with the following best practices for getting security right in your digital transformation:

Assemble the proper team

Before you can even begin to assess the potential risks involved in digital transformation you need to be able to assess the inherent risks as well as the laws with which you’ll have to be compliant. That means assembling the right team, including the following (some of whom may overlap, depending on organizational structure):

A senior level information security officer
Legal counsel or other experts capable of outlining compliance requirements
A team (or teams) reporting to the top information security officer to:
- monitor compliance, including staying abreast of changes to laws, rules, and regulations
- respond to security breach incidents
- respond to the consequences of breach-incidents (including interacting with end-users)

All of these team members should be embedded into your enterprise’s overarching business strategy, looping them in at every level of decision-making and execution.

Taking inventory and assessing the risks

With the proper team assembled, it’s crucial to take an inventory of:

All key processes
All systems that deliver key processes
All data delivered to, delivered by, stored in, and processed via those systems
All such data that is sensitive, proprietary, or otherwise subject to regulation
The laws, rules, and regulations applicable to that data
Existing vulnerabilities
Potential vulnerabilities
Industry-specific vulnerabilities

Creating policies and plans to address the vulnerabilities

This may include coming up with new ways of authenticating system-user credentials, policies regarding enterprise- as well as personal-devices, policies regarding security clearance for employees and others on the premises, and policies regarding use of networks and social media. Despite that one of the aims of digital transformation is a breaking down of information silos, it’s also critical to put protocols into effect that ensure any information made “accessible” as a result will be accessible only by those with a need, or permission, to know it.

Training and educating…everyone from employees to the chief executive

Some experts estimate that as many as 95% of all data breaches² are the result of human error. But that percentage includes error at the coding level at all levels of supply chain. Others place the percentage at closer to somewhere between 40%³ and 50%⁴, where the error is limited to user-interaction with the system in question. Whatever the percentage, the reality is that if you were to ask 10 employees what they might be doing that puts enterprise data at risk, at least half might not have any idea—that is, unless you provide them with training/education on system and data security. This includes general training/education about security, why it’s required, and what’s at stake when it’s compromised, as well as specific topics that address of-the-moment security risks. At this moment, that might include:

How to identify phishing schemes
How to identify unsafe websites and links
How to recognize malicious email attachments
Proper password management (including requiring strong passwords and periodic password updates)
Proper device and workstation security
Social media awareness

Laying down and enforcing security-focused protocols

Where training and education fail, protocols—especially those that are consistently enforced and periodically reiterated—can pick up the slack. For example, protocols regarding:

Using public networks
What to do if a device is lost or stolen
What can and can’t be shared on social media
What to do when sensitive information is requested by email or otherwise
Multi-step authentication processes disclosing sensitive data or access to databases containing the same
The use or ban from use of non-enterprise devices while on enterprise premises
The taking of photographs and screenshots on enterprise premises
The tracking and return of enterprise-issued devices and badges and other credentials upon termination of employment

Create a strong response plan

System and data security requires a response plan in the event of a breach. An effective response plan can significantly mitigate the damages of a breach. Such a plan would include:

A means for identifying new risks and vulnerabilities and a protocol for conveying them throughout the enterprise and to third parties who need to know
A means for detecting breaches long before the average detection time of 100 days
A protocol for responding to detected breaches, including:
- isolating affected system segments
- shutting down access to those segments and the data accessible within
- notification of whomever needs to be notified under applicable law (from end user to law-enforcement to forensics experts to attorneys)
- A protocol for post-incident procedures, including documenting the incident and collecting data to improve future responses and update security protocols to meet current risks
- A post-incident public relations/marketing response
- Embedding the response plan into the related business processes
- “Fire-drills” that reinforce the plan essentials in the minds of the key players

Keeping the “bad guys” out involves a combination of prevention, detection, action, and agility. Make sure your enterprise has all of these covered.

In the weeks ahead, we’ll be diving in to explore how system and data security dovetail with data privacy and all the laws and regulations with which your digital transformation provider should be compliant. We’ll also explore those security matters you’ll want to consider when choosing your digital transformation partner. If you missed the earlier posts in this series on cyber security, you can catch up here on:

Gotta read it all now? You can download the entire series as a flipping-book here.

In the future, be sure to subscribe to Exela’s quarterly thought leadership publication, PluggedIN for up-to-the-minute news and views on topics that matter to you.