If you’re reading this, chances are you spend a good chunk of your time keeping up with the latest news and opinions in the world of cyber security. And if that supposition is true, there’s also a strong chance that you’ve run across the concept of the “holistic approach” to cyber security culture already. In fact, headlines containing this phrase have been popping up like weeds everywhere info sec content grows. We sincerely hope that you’re not writing it off as another trendy platitude to sell endpoint protection.
The holistic cyber security approach is an idea that deserves discussion. It can be difficult though to glean some visualization clues as to what this holistic approach means beyond connotations of healing crystals and chakra therapy. What exactly would a holistic approach to cyber security look like in practice?
It may be prudent to first examine why this shift in ideology is emerging. First I’ll issue a warning: the following answer may be too cynical for readers that are faint of heart.
The truth is, we’ve been fighting the bad guys for over a decade and are no closer to “winning” the war than when it started. Don’t get me wrong, we have always put up a hell of a fight but even Sisyphus stops celebrating when he crests his thousandth summit. Daily, millions of network architects, security engineers, programmers, pen testers, and more are engaging in noble work and boasting massive strides in the protection of your data. New security layers are being added, threat signatures are being documented, and packet scrutiny is intensifying. But the bad guys are at their battle stations too. Every new feature or program unveiled is accompanied by its own unique slew of exploits. Let me be clear: this is a never-ending battle.
Cyber attackers are finding these pursuits are clearly worth their time and effort. You don’t have to dig very far into our previous blog posts to be reminded of the glaring statistical evidence that ransomware attacks are increasing at an extreme rate. High-profile attacks such as WannaCry and Petya are making regular appearances in an already overwrought news cycle. As serious as these staggering trends are, though, the concept of the holistic approach did not emerge solely in response to highly publicized attacks or to surges in certain species of malware. In fact, nothing specifically birthed any new ideology in cyber security because the “holistic approach” is nothing new. It is, at best, a rebranding. A repackaging of the same advice that the info sec community has been preaching for years: train your staff to identify threats, patch your system often, secure your most sensitive data.
The fact of the matter is the anatomy of a cyber attack has not changed much over the last few years. Someone in the office clicked something they shouldn’t have, they hesitated in reporting it in fear of repercussions, your security patches just never got around to being installed, and no one’s been accountable for data backups since Nelly was putting out new albums.
Perhaps I am giving away the golden-egg-laying goose for info sec bloggers, but the holistic approach to cybersecurity is nothing more than fresh phrasing for the need of a cyber safety culture in the workplace. Dirty secrets aside, there are still pertinent lessons to be learned. Whether you consider this cutting-edge insight or a refresher course, let’s dissect what the holistic approach to cyber security looks like in practice.
Striking a Balance Between Efficiency & Security
We live in a dangerous world. In our virtual lives, we must remain vigilant in guarding our identities and data. In our real lives, we worry over crime and random misfortune. An ever-present aspect of our fight for safety rests on the delicate scales balancing security on one side and efficiency on the other. Certainly we could be 100% secure if each email and document entering our network was personally read and reviewed by a network engineer before getting the thumbs up or down. Unfortunately, this would eat up a lot of time and a lot of labor. Your employees can’t sit around half the day while necessary emails trickle through the gateway. Likewise, it would be super efficient to hand over admin credentials to every employee, contractor, and vendor on your payroll so that they can help themselves to whatever resources are needed to get the job done. Somewhere in the middle, a balance must be struck. I may be biased here, but I encourage you to err on the side of security over productivity.
You’re On the Crew, Like It or Not
If your employer has a computer on property, guess what: you’re part of the cyber security team! Whether you’re the sys admin or the janitor, everyone has a role to play. Empower and educate your employees at all levels in the basic habits most likely to prevent a breach. Email security best practices should not be optional curriculum for new hires or annual retraining.
What Is Governance Anyway?
Cyber security governance is a hefty phrase that could do with unpacking. In this case, governance is the codified operating procedures in place to manage and enforce cyber security in the workplace. This is the infrastructure behind the lectures. The bite behind the bark. Strong cyber security governance means having accountable parties tasked with monitoring and enforcing info sec protocol. It includes having clear, concise rules outlined in employee manuals. It includes real, visible consequences for flagrant disregard of those rules. Cyber security governance is corporate speak for a company walking the walk of cyber security instead of just talking the talk. If an employee unwittingly allows a threat onto the network because they’re unaware of the procedures that could have prevented it, you share the blame.
With Our Powers Combined..
Technical! Physical! Human! Okay, maybe this dream team of cyber security assets isn’t quite as screen-ready as Captain Planet’s squad, but it gets the job done. Another aspect of the holistic approach is a widening of your cyber security scope beyond UTMs. Having the most secure network money can buy will amount to nothing if the bad guys walk into your unlocked server closet, unplug your appliances, and jet. Or worse yet, you may find yourself in a Scooby Doo situation wherein unmasking the bad guy reveals someone assumed to be on your side. Insider attacks are a growing concern across industries of all shapes and sizes.
Whether it’s malicious insider attacks or just gullible Dave in Accounting responding to a phishing scam, human beings are much more likely than technological assets to be the wrench in your cyber security gears. A holistic approach incorporates staff training to combat social engineering as well as physical security measures to secure your hardware from break-ins.
Your company will face with a cyber attack one day. The threat of ransomware has graduated from worrisome to inevitable. In the second quarter of 2017, UK businesses experienced an average of 105 breach attempts per day. A holistic approach, a culture of cyber security, a security awareness mentality, Uncle Admin’s Special Funtime No-No’s: you can call it whatever you dream up so long as you actually implement the pillars of breach prevention. Only when we all get on the same page and work towards a common goal will the dream of vanquishing the bad guys be possible. I encourage you to put me out of a job. If a ransomware attack is never again recorded in the info sec archives, Firewalls.com would be thrilled. Sure, we’d have to hang up our lucky engineering pants, but we could always go make Mobile games or something. Unfortunately this dream world does not yet exist. Until then, we’ll do our part in the fight.
What’s your next step?