Businesses are as unique as the products and services they sell, but CISOs across industries share a common challenge: building a security program that actually works for their organization. Why is protecting an organization's most sensitive data and technological capabilities so confounding?
I recently sat down with DeWayne Alford, VP of Security Operations at Digital Hands, to put that question to him directly. He agreed with the premise and added a second, equally significant challenge: many companies simply can't detect suspicious or malicious activity in their own environments. His answer to both: start with the users. Most don't.
"Users are your biggest weak point," Alford said, "and they are the hardest to detect problems for." Understanding how an organization's users interact with its network and environment is the starting point for any sound security program. It's the step most overlooked when teams reach for a turn-key commercial solution instead.
The silver bullet that isn't
There's no shortage of out-of-the-box security solutions, and many companies are seduced by the slick promises in the marketplace. "We get the fun of working with a lot of security tools," Alford said, "and a lot of them promise some kind of silver bullet. Unfortunately, that's not usually the case."
He recounted one engagement where he had to work with an organization's developers and engineers to make a purchased platform actually function. What the company had bought had to be essentially rebuilt from scratch — a complete waste. There's no one-size-fits-all in security. If starting with users is the key, that shouldn't be a surprise. Every set of users is different.
The closed-loop process
When companies do buy off-the-shelf, Alford said, many CISOs lack the time or appetite to test their products thoroughly. He recommended what he calls the closed-loop process for any new security product or service:
- Define the goal. Determine, clearly and specifically, what the product or service is supposed to accomplish.
- Implement. Deploy the product against those defined goals.
- Test rigorously. Confirm the product is actually meeting its stated goals in your environment.
- Review and analyze. Examine the results.
- Circle back. Compare what you found to the original goals; tweak as needed.
It's a continuous cycle of investigation and testing — initiated every time a new step or product is introduced to the security program.
Five steps that work
Despite the multiple repetitive cycles, "cybersecurity needn't become complex or cumbersome," Alford assured me. He outlined the five steps he shares with every CISO he speaks with — from small organizations to large enterprises, all of whom, he says, "basically have the same requirements":
- Secure your users — email security, MFA, awareness training
- Get eyes on your environment — perimeter, endpoints, logs
- Patching — a robust way to look at patches and existing vulnerabilities
- Governance — back the above with thoughtful, comprehensive policies and procedures
- Testing — confirm posture matches expectation through pen tests, simulations, etc.
The key caution: testing is only meaningful if conducted in order. Steps 1–4 must already be in place before testing produces useful results. And none of it works if people stay in their own silos, without communication, collaboration, or commitment to the organization's governance. The program has to be comprehensive and applied across the board.
"Cybersecurity can be simple," Alford said. "Not easy — but simple. It just takes a sound strategy to pull it all together." In an evolving and complex landscape, that simplicity is what holds.
Shira Rubinoff is a cybersecurity executive, advisor, and thought leader. This piece was a guest contribution.