How CSOs can avoid the shadow of a cyber security Groundhog Day

Every year, in the US town of Pennsylvania, people gather in droves to watch a groundhog predict how much longer winter will last. For Americans, it’s a pretty big deal to see this glorified gerbil pop up and look terrified as throngs of onlookers wait in hushed silence to see whether the mighty Phil from Punxsutawney will see his shadow. 

Historically, the varmint is only 39 percent accurate, but in truth that’s probably better than most human non-groundhog meteorologists.

Like groundhogs, security leadership and CSOs constantly emerge from their burrows — excuse me, offices — and tentatively look around for their shadows. In this scenario, it’s usually a compromise or data breach.

Once they see it, they scurry back below ground to their safe space where they cross their fingers and hope everything blows over. They can re-emerge once the bad weather is gone.

This plays out time and time again. Year after year, more security leaders see their shadow. Why? Because when it comes to cyber security, people usually face the same direction. Unfortunately, the position of the sun (the security industry itself) typically doesn’t move much. 

CSOs tend to fall into the same traps day in, day out, in an often vicious, unbreakable cycle (sort of like the plot of the movie “Groundhog Day”).

 

Security becomes a constant game of whack-a-mole (or whack-a-groundhog, in this case); a threat pops up, you try your best to knock it back into its hole, only to have another appear. Then another, and another. It’s nearly impossible to keep up. The shadow of the last breach or most recent compromise is always there, taunting them.

In the end, it leads to six more weeks (or more) of winter (subpar security).

Break the Cycle

Attitudes toward security must shift if security leadership and CSOs ever hope to stop staring at that shadow and break the cycle. Here are some best practices cyber security pros can leverage to break out of the Groundhog Day rut and improve security. It’s time to emerge shadow-free:

·         Be proactive. Trying to stop threats as they occur is inadequate. Eventually, you’ll be overpowered and something will get through. Protect the network and your apps at the edge. Put solutions in place that catch and mitigate threats before they get in.

·         Defend your network and apps. Do you have adequate protection from DDoS attacks? How about the ability to uncover threats concealed in SSL- encrypted traffic? These types of solutions can help you avoid reliving the same attacks over and over again.

·         Create and enforce a strong security policy. An unenforced security policy is less valuable than the paper it’s printed on. Hold end-users, employees and yourself accountable. Companies will spend a great deal of time drafting security policies that ultimately go unenforced.

·         Train your users. Do your end-users know how to set strong passwords across personal and business accounts? How to use two-factor authentication? How to spot a phishing email? Train them to be security-minded.

·         Think security first. So often, security is an afterthought. When you spin up apps and solutions, security should always be among the first questions.

·         Test and assess. Perform tests on your network and applications to uncover any potential vulnerabilities. Just because you haven’t seen it, doesn’t mean it isn’t there. Regular tests can break you out of the repetitive cycle of fighting threats.

These simple steps can help CSOs avoid seeing their shadow and getting stuck with six more weeks (or much longer) of bad security.