Cybersecurity has changed more in the last five years than it has in the ten years preceding it. Cyberattacks are constantly changing and evolving, but cybersecurity professionals must have structure and strategy; without structure and a plan, cybersecurity professionals will continue aimlessly in their pursuit of protecting the organizations they serve.

All this change is chaos and disorder, a new form of fear, uncertainty, and doubt (FUD), one, although backed by facts, fails to have direction or a documented strategy.

If it is so difficult for us to document our cyber assets and identify those assets that have an impact on our organization's revenue, how in the world are we going to do anything about the threats we face?

We can’t, it’s that simple. And any CISO call to arms that suggest we can is a stopgap measure, a call to disillusionment and ultimate disaster because our stopgaps are not solutions. 

Fortunately, there are tools to assist us with strategy...

With laws and regulations increasingly requiring organizations to demonstrate that mission or business-critical information systems and IT infrastructures are protected; the challenge becomes, with over 164,000 known vulnerabilities in the Common Vulnerability Exposure (CVE) database and 546 attack patterns, so far identified and documented by Common Attack Patterns Enumeration and Classification (CAPEC), where do you start?

In a study that became known as the “Jam Experiment,” Iyengar and Lepper (2000) were the first to demonstrate the choice overload effect, referring that large choice sets attract people. Still, at the same time, these wide choice sets increase the choice difficulties. As we draw a parallel, cybersecurity professionals face many vulnerabilities (>164,000) and many assets to protect against, leading to unsatisfactory solutions. 

Most guidance offered to Subject Matter Experts (SMEs) or organizations for that matter, lead them to identify the...

President Biden’s Statement on National Cybersecurity

President Biden stated, “If you have not already done so, I urge our private sector partners to harden your cyber defenses immediately by implementing the best practices we have developed together over the last year. You have the power, the capacity, and the responsibility to strengthen the cybersecurity and resilience of the critical services and technologies on which Americans rely.”

However, the real question is, are organizations ready to implement cyber defenses? The basis for this rhetorical question is that with the speed of change, IT transformations, new mandates, and the great resignation, among others, organizations may be challenged to implement cybersecurity strategically. There’s no lack of guidance for Critical Infrastructure or Corporate Infrastructure, with standards and frameworks, such as:

• ISO/IEC 27001
• ISO/IEC 27032 on cybersecurity 
• the multipart ISO/IEC 27033 on network...

Five challenges 

First, the objective of improving cybersecurity is vague and broad. Sometimes organizations struggle on how to measure any improvements to their cybersecurity posture or post-investment. What is even worst, it’s that you may be measuring the wrong thing. In 2015, the Global Information Security Workforce Study (GISWS) conducted a survey of more than 14,000 security professionals, of which 1,800 were federal employees. The survey concluded that we are not just getting better, but we are going backward.  

Although it seems pessimistic, it is supported by facts; in 2014, one billion records were compromised the year before the survey, which triggered Forbes magazine to refer to 2014 as “the year of the data breach.” If you jump forward to 2021 and benefit from hindsight, we can confirm that the GISWS survey’s conclusion that we are going...

I read an article the other day titled, “Global utilities lacking basic cybersecurity practices.” Although the article was focused on utilities, the guidance applies to every industry, so I will touch on a few recommendations that could be useful to you as well, regardless of industry.
The article was based on an interview with Rafael Narezzi, Chief Technology Officer at CF Partners. In the webinar, Narezzi urged energy companies to increase investments in cybersecurity and be proactive. In addition to investments, he encouraged companies to make cybersecurity a main driving force of the business.
Let’s reflect on this statement; it says to increase investment in cybersecurity, which would be wise for any organization; however, increasing investment without a strategy would be detrimental to any business, especially small to medium-sized companies. Perhaps I’m taking this statement out of context, and Narezzi’s audience knew what he meant with it, but let...

Assets Classification

Let us start with why asset classification is so essential; asset classification is the foundation of everything else to come in cybersecurity; it will help your organization, for example, small or large, to better understand, manage, identify, and classify your assets. Here is the challenge, the business will hear, "oh, you want to spend how much, just to know what we have, which you should have known to begin with?" These are tricky questions to answer, as the business sees no value in this effort, it is not making their product or service better, the customer does not see any improvements in service or features, and so on.

However, it will assist your leadership in determining which processes and assets are the most important in assuring critical operations, service delivery, and overall business resilience. This, in turn, indicates where to focus your cybersecurity investments in a world of limited budgets and increasing costs. Now you could...