[BreachExchange] The Single Cybersecurity Question Every CISO Should Ask

[Destry Winant]

https://www.darkreading.com/application-security/the-single-cybersecurity-question-every-ciso-should-ask-/a/d-id/1334376

In early December 2018, several major corporate breaches were made
public. As the news was shared and discussed around my company, one of
my colleagues jokingly asked, "I wonder if I can gift some of this
free credit monitoring to my future grandchildren." It was a telling
comment.

Today, every organization – regardless of industry, size, or level of
sophistication – faces one common challenge: security. Breaches grab
headlines, and their effects extend well beyond the initial disclosure
and clean-up. A breach can do lasting reputational harm to a business,
and with the enactment of regulations such as GDPR, can have
significant financial consequences.

But as many organizations have learned, there is no silver bullet – no
firewall that will stop threats. They are pervasive, they can just as
easily come from the inside as they can from outside, and unlike your
security team, who must cover every nook and cranny of the attack
surface, a malicious actor only has to find one vulnerability to
exploit.

The security challenge is compounded by the security talent gap, which
has reached crisis levels. That is why executives in every industry
must ask themselves: How do I scale the resources I have to meet the
cybersecurity needs of my organization? The hidden answer: IT
operations.

Uniting for a Common Purpose
In a world in which security and IT operations are often at odds, this
may seem counterintuitive, but the truth is what SecOps calls "the
attack surface" is what IT ops calls "the environment." And no one
knows the enterprise environment – from the data center to the cloud
to the branch and device edge – better than the team tasked with
building and managing it.

Many of our most sophisticated customers already use IT operations to
help build a more robust security posture. Drawing from conversations
with these organizations, industry analysts, internal experts at
ExtraHop, and my own experiences from decades working in business
operations, here are some of the most important things CIOs and CISOs
can do to create a co-operational framework for security and IT ops.

• Security cannot come at the expense of uptime: For any organization,
ensuring the consistent availability and performance of
business-critical systems is paramount. If a security measure
compromises availability, the business itself is compromised. Security
teams need to work with IT ops and line-of-business stakeholders to
understand performance requirements and then build a security
framework that accounts for an acceptable level of risk.

• It's OK to fail if you can recover: Efficient business operations
always require some level of risk, and that means accepting that some
failures are going to happen. For security teams, this means accepting
that malicious actors will get in. The question becomes how quickly
you can detect, investigate, and stop that activity.

IT operations, with its working knowledge of system behaviors and
interactions, can play a vital role in helping to detect threats
before they result in disaster. They just need the tools and
understanding to know what to look for. Just as line-of-business
stakeholders work cross-functionally to scale knowledge and improve
outcomes, security and IT ops will better serve the business through
collaboration.

• Responsibility for secure operations can and should be shared: If
you provide IT ops with the right tools, it’s possible for SecOps to
use IT ops for some important security activities. These should be
lower on the risk scale, and they should be things that don’t require
a high degree of specialized knowledge.

• Cooperation benefits compliance as well: While breaches grab
headlines (and garner record-setting fines), compliance failures can
also have significant business consequences. Regulations such as GDPR
and HIPAA require organizations to meet strict standards for
protecting data and privacy. While SecOps and IT ops play their own
roles in ensuring clean and compliant practices, sharing both
knowledge and resources is a smarter way of scaling to meet compliance
demands.

Moving Forward
>From the interactions between applications to how to create secure
configurations, far too often we find that IT ops and SecOps fail to
share important knowledge. As too many organizations have learned the
hard way, this siloed, sometimes oppositional model can have serious
consequences.

There is no perfect fix for cybersecurity, and nothing will ever be
100% secure. Threat actors are highly motivated to find new and
innovative ways around every solution that tries to keep them out. But
with a combination of strategy, structure, staffing, and systems, it’s
possible to gain an advantage that will evolve and scale to keep
disaster at bay.

Finding talented security professionals is becoming increasingly
difficult. But when you promote an environment of cooperation and
communication, you can build a more scalable enterprise security
solution for 2019 and beyond. At the end of the day, the best team
wins.