Cybersecurity: Don’t Forget the Management Fundamentals

Cybersecurity: Don’t Forget the Management Fundamentals

Cybersecurity: Don’t Forget the Management Fundamentals

 
Advances in tooling, education, and job training provide organizations with the opportunity to advance their own cybersecurity programs.

If not impenetrable, they are at least harder to breach and therefore a less attractive target than the next organization. It may be tempting to assume new tools solve problems and erase or lessen the need to understand management fundamentals as they apply to cybersecurity. Instead, it is vital to consider how effective cybersecurity depends on management fundamentals, especially on sound resource allocation.

One of the most important skills a successful businessperson cultivates is the ability to properly allocate resources to achieve maximum results. Resource allocation decisions vary according to many factors, but the decision-making process is crucial, if not dependent on the business environment. Often, but not always, governed by business needs, cybersecurity programs are constrained by limited resources facing potentially unlimited threats.

Resource allocation decisions are especially acute given the asymmetric nature of cyber-warfare: relatively small numbers of attackers successfully penetrate enterprises that have dramatically more resources and equipment. The decisions for allocating cybersecurity program resources must be driven by a sound process that includes risk assessment, leading to a risk-based allocation of resources.

One approach to allocating resources according to risk begins with documenting every step, process, piece of equipment, or software between computer hosts and people at each end of a transaction. In this case, you might consider one attack scenario a “transaction.” Draw it out and consider where vulnerabilities might be (all of them…there will be a lot), which ones are mitigated already (hopefully, also a lot), what systems and applications are already hardened, where security tooling can apply, how and where people are trained (everyone should be trained according to their role), and where gaps exist. In practice, this process can be complicated. Organizations may not be able to map the transaction process from end to end, and it may extend beyond their networks. Think about it conceptually, then divide the concept into manageable chunks (mobile, perimeter, internal, training, etc.). Taking small steps in the aggregate builds a holistic program and injects expert knowledge of likely risks.

Sometimes it is worthwhile to pass up new capabilities and apply resource elsewhere to reduce risk.

For example, a Chief Information Security Officer of a large multinational company had new information technology assets popping up “like popcorn” because the company was continually acquiring smaller companies. In these cases, an external threat can become an insider threat very quickly. These threats may not be detected applying advanced data analytics to system logs or behavior – there is not enough data yet. Countering that threat requires a rigorous onboarding checklist and procedure for IT assets, and personnel to identify a threat before any trend analysis would have been feasible. In this context, fundamental best security practices apply over a bleeding edge technical solution.

Contributors

* Arc Aspicio |

Arc Aspicio is a management, strategy, and technology consulting firm that takes a mission-oriented approach to complex client challenges. As a rapidly growing company, Arc Aspicio has a bold strategy for 2016-2018 that drives growth through new capabilities in strategy, design, human capital, data analytics, information sharing, cybersecurity, and strategic communications. The company is known for a strong, collaborative culture that values gratitude – for its clients and its great team. And, #welovedogs! Follow us on Twitter @arcaspicio or learn more at www.arcaspicio.com.

Lynn Ann Casey / Chief Executive Officer
info@arcaspicio.com
703.465.2060

Top Qualities of Design Thinking Leaders

Top Qualities of Design Thinking Leaders

Design Thinking is on the rise in the business world. Design Thinking leaders focus on creating the best product for their clients and working with the experiences and insight of fellow coworkers. Some of the key characteristics of Design Thinking leaders present themselves in individuals who are open and subject themselves to vulnerability with clients and coworkers. These qualities help leaders to connect and build relationships with others. They also create an open flow of communication that allows for others to better share their knowledge to align with and understand the company's mission.

Think, Key, Speak: Purposeful Communications

Think, Key, Speak: Purposeful Communications

I spent the early years of my career in the United States Navy as a Naval Flight Officer on the E-2C Hawkeye, the Navy’s aircraft carrier-based Airborne Early Warning and Command and Control platform. The various missions of the aircraft demand that aircrew monitor up to ten radio frequencies, and actively speak on three or four of those, at any given moment in flight.

How Can Communities Ready Themselves for a Major Power Grid Event?

How Can Communities Ready Themselves for a Major Power Grid Event?

Communities are often the foundation for an expedited recovery following major events. But how can communities strengthen their response to, for example, a major cyber-attack or natural event, such as an Electronic Magnetic Pulse solar flare? A United States electrical grid failure could destroy a number of the nation’s high voltage transformers causing widespread outages for several weeks, even months. A public health emergency could quickly ensue particularly among the vulnerable as the ripple effects cause significant societal disruption. The Federal Emergency Management Agency’s (FEMA) strategic plan encourages and empowers communities to prepare for the inevitable impacts of future disasters. How can communities prime for major events?

Confessions of a Chief Strategy Officer

Confessions of a Chief Strategy Officer

I’ll admit it, I was a little smug. After more than 20 years in the consulting business helping clients develop, implement, and integrate their strategies, I thought… “how hard could it be to do the same things for my own company – a company of consultants?” I had the commitment of my leadership, a group of talented people, and a plan and resources to grow the company. We had energy and we had a great process and tools to successful. What could go wrong?

Exploring Trends in Strategic Workforce Planning (Attract, Engage, and Retain)

Exploring Trends in Strategic Workforce Planning (Attract, Engage, and Retain)

Federal agencies have been undergoing significant transformation, requiring effective workforce strategies that can assist them in facing increasing challenges. As government leaders look for and implement initiatives to improve performance, Strategic Workforce Planning, (SWP) has become instrumental in assisting organizations to focus on their most important resource: their people

#Innovate Your Heart Out: We See an Innovation Day in Your Future

#Innovate Your Heart Out: We See an Innovation Day in Your Future

Innovation is difficult to harness for organizations of all sizes (Government and private sector alike). Replicating a process to encourage and produce innovation is even more challenging. Innovating in a structured space and time seems counter-intuitive, and begs the question: can thinking outside the box be a structured activity? Arc Aspicio recently held an Innovation Day to answer this question.

A Unified Brand Helps Serve a Complex Mission

A Unified Brand Helps Serve a Complex Mission

The Department of Homeland Security (DHS), created in 2003, undertook the most significant reorganization of federal agencies since the Cold War. It brought together federal, state, local, tribal, and territorial agencies with a focus on securing the U.S. from threats in a collaborative way. DHS pulls together five complex mission areas: preventing terrorism and enhancing security; managing our borders; administering immigration laws; securing cyberspace; and ensuring disaster resilience.