Cyber Defense eMagazine March Edition for 2022

egarding the use (or not) of various cybersecurity measures against their cost, and most have chosen
to implement at least some protective measures. So, yes, the corporate world has learned that not taking
measures to safeguard their networks would likely negatively impact their bottom lines at some point;
however, I would again say no to whether they generally do enough or to whether they’re generally using
the appropriate tools.
Also, why do we still need to tell a story about cybersecurity to change corporate culture and get serious
funding for security? Just walk around your organization, and everyone is on the network. Without it, little
work gets done and productivity drops significantly. If this tool is so important, why do we not treat it as
such? If Gartner’s data is accurate, lessons are coming slowly to many corporations:
• By 2025 ONLY 40% of boards of directors will have a dedicated cybersecurity committee
• By 2025, ONLY 70% of CEOs will mandate a culture of organizational resilience to combat threats
Another lesson still being taught: Do most corporations know they should be enforcing updates for known
security vulnerabilities that have been documented and announced by respective cyber communities to
keep us all safe? The answer is yes, but do most of them do enough or do it effectively? That answer is
no. Otherwise, consistently updating computers and keeping them current with the latest patches/security
fixes across the enterprise would stop 99% of vulnerabilities exploited to date.
Inconsistent system updates greatly expand cyber vulnerabilities and risks. If this is known and
understood, then why is it seemingly so difficult to succeed at attaining effective cybersecurity? It’s
because many companies don’t effectively cultivate three critical components of their cybersecurity
processes: 1) people, 2) culture and 3) technology. We must have people who follow the security
processes, a corporate cyber culture that supports its people and the processes, and the technology to
implement the processes, when necessary.
If we agree these are three critical components of effective cybersecurity processes, then we must
remember that people are trainable; the culture can be fixed with training and leadership from senior
management; and technology is constantly adapting with the use of artificial intelligence and machine
learning. Strengthening cybersecurity processes through people, culture, and technology costs
corporations valuable time and money, so it’s wise to use these three resources in the most practical and
beneficial ways possible. This often means that the latest and greatest technologies or programs aren’t
actually necessary to achieve effective cybersecurity.
As an example, look at zero trust. It is an architecture and not a technology, but the cybersecurity industry
very often wants customers to buy all new equipment to implement zero trust. This ends up helping the
bottom lines of the said cybersecurity companies, but are organizations any safer? That is often arguable,
but even newer tools have no better chance of succeeding than in the past unless the people using them
use them appropriately, born out of a culture that teaches and supports such use.
Aside from malicious actors themselves, if we believe people, or network users, are one of the biggest
threats in the cybersecurity realm, an immediate and cost-effective fix is to engender a culture of
cybersecurity professionalism in our everyday users. Train the users to not only prioritize necessary
updates on their systems but to follow other cyber hygiene measures regarding the use of email, the
Cyber Defense eMagazine – March 2022 Edition 44
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.