As a newly minted CISO, I have been injecting myself into the Ntirety environment, talking security at every corner of the company. I come from a deep IT/security background where I have seen many companies fall prey to the ever-increasing cyber threat landscape.
Sad Tales Abound
In my previous roles with Hewlett Packard Enterprise and the FBI, I would often speak with companies before and after they had been breached. One of my saddest experiences was with a prospective SMB customer who was concerned about security in his environment but wasn’t sure where to start. We discussed various options including the deployment of a Firewall or maybe a security assessment to help him determine where the “right place to start” was.
He was non-committal, and we departed the meeting agreeing to meet again in a few months to see where he was in his decision. I was concerned because I felt his corporate network was exposed and the threats against his company were rising as his company became more successful and lucrative.
You can imagine my horror when his company was hit with a ransomware attack six weeks after our conversation. I sent my corporate contact an email expressing my desire to help in any way. Could I have done more? Could I have been more convincing? I don’t know, but my desire is to assist every customer in any way possible. I want every customer’s environment to be more secure than when I first met them.
Basic Security First
What is the proper order to assist a customer in an insecure environment? It feels like a “Chicken-or-the-Egg” conversation – do we secure the environment and then do a security assessment, or do we start with a security assessment and then see what we need to secure. I feel like I have come down in the camp of basic security first, then let’s assess.
One of the first conversations I have with any customer is a request for the customer to assess their security on a scale from 1-5 with a 1 being almost completely insecure. If a company rates themselves as a 1 or 2, that means they know they are not secure or very easy to compromise. I feel like we should immediately discuss how to get them some form of security before talking about a security assessment: At a minimum some firewall protection and maybe multi-factor authentication but in this case, my experience has shown that the low-hanging fruit security gaps become easy targets.
This may go against conventional wisdom, and I have often been the champion of the security assessment first, but I worry that by delaying any action on securing an environment, we may leave the door open too long for an enterprising criminal to exploit another company. The thought of another company being victimized while I am trying to help them is too much. Let’s move the minimum security bar higher in all of our environments and make the criminals’ job that much harder.
