With or without COVID related uncertainties, one certain issue is that business owners have to act quickly to implement a cybersecurity plan/framework as it is stated in Ohio SB 220 senate bill for safe harbor in the event of a cyberattack. An ad hoc approach poses a very risky outcome related to companies’ digital assets.
Change without planning, testing or much discussion has opened massive security gaps in terms of IT structure. How prepared are you for a cyberattack? By using the 5-point NIST system, you can systematically analyze your cybersecurity preparedness and take the right steps. The NIST approach helps you to:
1. Identify security risks
2. Protect against cyberattacks
3. Detect unauthorized access
4. Respond to security incidents
5. Recover from a breach
By building an information security plan around these 5 facets, you can mitigate risks such as working from home and stay prepared for tomorrow’s emerging threats. Learn what the 5 functions of the NIST framework are and how to use them to create your multi-layered network security plan.
1. DISCOVER WHAT’S WRONG: IDENTIFYING CYBERSECURITY RISKS
First things first: you need to know exactly what you’re dealing with in the threat landscape. Examine and identify cybersecurity risks across your physical IT assets, software, policies and people.
As an example, in work-from-home environments, a key physical risk is the fact that so many devices with sensitive data are off-premise. Theft and loss are real issues. In a large organization with hundreds or even thousands of devices off-prem, there’s a good chance someone will lose their phone or laptop.
Software and policies
The tighter your policies are, the less risk there is of a security incident. However, you’ll need to balance this with practical needs and productivity issues.
Employees often use certain devices for both work and personal reasons. Do your policies specify what kind of data can and cannot be stored on a smartphone? Do you have MDM (mobile device management) in place to monitor and control the types of apps employees install on their phones?
The human risk factor
Your people matter too. In a work-from-home environment, which is more prevalent at the moment, human risks multiply since employees are no longer on-site and have to juggle personal life alongside work.
The SB220 senate bill requires companies to adopt a cybersecurity framework for legal safe harbor in the event of a cyberattack. You need to evaluate whether or not your people have been trained adequately to respond to potential attacks.
2. WHAT YOU NEED TO DO: PROTECTING YOURSELF AGAINST CYBERATTACKS
There are 2 key dimensions to protection you should consider: protecting and monitoring access to assets and information and empowering your staff.
Access and control
You need to take steps to monitor and control digital assets. This could mean routing connections through a VPN, enforcing strict policy settings for app installation or implementing 2FA (two-factor authentication).
A cybersecurity framework is critical for legal safe harbor in the event of a cyberattack. Your overall goal here is to make sure that all physical assets and data – whether they’re on-prem or remote – are accounted for and under control.
Protecting your people
When protecting your people against cyberthreats, ask yourself these questions: Is cybersecurity training part of your onboarding procedure? Do you offer workshops and training to keep staff up to date with emerging threats? Do you clearly communicate your IT security policies?
A simple but effective NIST recommendation is replacing passwords with passphrases. Passphrases are strings of common words that are easy to memorize but harder to guess for computers than passwords. “Touch plate purple crab” takes over 400 years longer to crack than “Elisi0n4t3!”
3. THAT’S NOT SUPPOSED TO BE HERE! DETECTING UNAUTHORIZED ACCESS
There’s no such thing as a cybersecurity cure-all. You need multiple security layers to detect today’s increasingly complex cyberattacks. Every tool your IT team uses has its uses and its limitations.
Antivirus isn’t enough
At the top level, you need an enterprise-grade anti-malware solution – that’s your first line of defense. Unfortunately, many businesses call it a day after that.
An antivirus app by itself just doesn’t do enough to offer you real protection. 24x7 automated monitoring or eye-on-the-glass monitoring with cybersecurity analysts is vital, alongside firewalls and secure communication channels. Make sure your computer security strategy is designed to tackle today’s threats, not yesterday’s.
4. TACKLING THE THREAT: RESPOND AND MITIGATE
No security strategy is 100% foolproof. Sooner or later, you will have a security incident on your hands. The difference between success and failure lies in how well you respond – the steps you take to mitigate the impacts of the incident.
You need to have an incident response plan prepared and rehearsed. You should be clear about your security team’s responsibilities and the measures you’re deploying. Immediately after an incident takes place, analysis and a postmortem are important. Evaluate how your incident response plan held up and identify points for learning and improvement.
5. GETTING BACK IN SHAPE: RECOVERY
Even in a best-case scenario, you will lose time, effort, data and resources to a security incident.
Do you have a recovery and continuity plan for security incidents? You’ll need to implement this as soon as the dust settles to ensure your assets get back in shape with minimal downtime.
Your people – and external stakeholders – might also be affected. This is especially serious if you hold large amounts of customer data. After an incident, you will need to activate external and internal communication channels to keep all stakeholders in the loop and restore confidence.
THERE’S NO RIGHT OR WRONG WAY TO DO NIST. BUT THERE IS A BETTER WAY
NIST is a broad framework. There is no right or wrong way to implement NIST cybersecurity recommendations. However, experienced cybersecurity partners like Arnet offer you peace of mind with the best possible protection based on the NIST framework. Follow the steps we outlined in this article and your network security will be “dy-no-mite.”
When you work with trusted cybersecurity companies like Arnet, you don’t just get security – you get unprecedented awareness about the threat landscape and compliance and the opportunity to transform your organization’s security posture.
At Arnet, we customize our NIST-based security solution to work towards your business objectives. Are you ready for secure, comprehensive and cost-effective security to achieve your business goals? Are you ready for Arnet? Call us today (1-888-487-6057) or sign up for a free security and vulnerability assessment – take the first step toward secure, cost-effective cybersecurity that WORKS!
