If you are a business owner, a state/county/city elected official, or other organization leader, you likely are getting more nervous with every story you hear about another cyber security hack or ransomware attack on the many companies, governments and other organizations that happen every single day. If you aren’t, what’s wrong with you? Get your head out of the sand because you should be scared to death!
So, what can you do? Clearly hiding your head in the sand is out of the question (see paragraph above). Denial is never an option. NO ONE is safe from cyber attack. Even if you believe that you’re below the radar of a targeted attack, your organization is still at risk of one of your employees making a simple mistake and clicking on a phishing link.
Obviously, you need employees. So getting rid of all your people (including yourself) is not an option.
There are three things every organization needs to ensure the best level of cyber security: (1) a clear understanding of your environment, (2) up-to-date technical tools, and (3) a trained workforce.
The first step requires having a comprehensive “vulnerability and threat evaluation” of your network. This starts with an evaluation of all technical tools, the architecture of your network, outdated software (e.g., anti-virus, operating systems, etc.), and an investigation into whether there is any malware or uninvited guests lurking in your system already. It also includes an evaluation of your physical security (are server room doors locked with access control?) and policies (password management, bring your own device, access management, etc.). Most importantly, it includes an evaluation of your employees’ understanding of cyber security and the amount of training they receive.
The next step is to take that information and decide with your cyber security team what you need to change. This is “transformation management”. This will include the addition or upgrade of technical tools (patching, network monitoring, endpoint protection, anti-virus), implementing or changing policies to provide better guidance in accordance with your management priorities, and training for your employees.
Once you go through the transformation phase, you cannot just “set it and forget it”. Cyber security is an on-going endeavor. It is not a destiny, it is a journey. As cyber criminals become more sophisticated in their attacks, cyber security teams must keep up by developing stronger technical tools to prevent attack, continually monitoring to detect intrusion, stopping attacks as early as possible, mitigating damage and recovering quickly. This is the phase in which you need a “Chief Information Security Officer” (or Virtual CISO) to manage the monitoring of your network and analyses, implement on-going training and ensure updates are made to software as soon as they are available.
Lastly, no one can guarantee you will never experience a cyber breach. Therefore, you must prepare by developing an incident response plan which will ensure your operations are back up and running as quickly and efficiently as possible.
Whether you are a business, a public organization (i.e., county government, sheriff’s office, county jail, etc.), or a non-profit, you are at risk of a cyber incident whether through malicious activity or negligence. The most responsible course of action to ensure you continue to operate in any scenario is to be proactive.