Cybersecurity: Don’t Forget the Management Fundamentals

Cybersecurity: Don’t Forget the Management Fundamentals

Cybersecurity: Don’t Forget the Management Fundamentals

 
Advances in tooling, education, and job training provide organizations with the opportunity to advance their own cybersecurity programs.

If not impenetrable, they are at least harder to breach and therefore a less attractive target than the next organization. It may be tempting to assume new tools solve problems and erase or lessen the need to understand management fundamentals as they apply to cybersecurity. Instead, it is vital to consider how effective cybersecurity depends on management fundamentals, especially on sound resource allocation.

One of the most important skills a successful businessperson cultivates is the ability to properly allocate resources to achieve maximum results. Resource allocation decisions vary according to many factors, but the decision-making process is crucial, if not dependent on the business environment. Often, but not always, governed by business needs, cybersecurity programs are constrained by limited resources facing potentially unlimited threats.

Resource allocation decisions are especially acute given the asymmetric nature of cyber-warfare: relatively small numbers of attackers successfully penetrate enterprises that have dramatically more resources and equipment. The decisions for allocating cybersecurity program resources must be driven by a sound process that includes risk assessment, leading to a risk-based allocation of resources.

One approach to allocating resources according to risk begins with documenting every step, process, piece of equipment, or software between computer hosts and people at each end of a transaction. In this case, you might consider one attack scenario a “transaction.” Draw it out and consider where vulnerabilities might be (all of them…there will be a lot), which ones are mitigated already (hopefully, also a lot), what systems and applications are already hardened, where security tooling can apply, how and where people are trained (everyone should be trained according to their role), and where gaps exist. In practice, this process can be complicated. Organizations may not be able to map the transaction process from end to end, and it may extend beyond their networks. Think about it conceptually, then divide the concept into manageable chunks (mobile, perimeter, internal, training, etc.). Taking small steps in the aggregate builds a holistic program and injects expert knowledge of likely risks.

Sometimes it is worthwhile to pass up new capabilities and apply resource elsewhere to reduce risk.

For example, a Chief Information Security Officer of a large multinational company had new information technology assets popping up “like popcorn” because the company was continually acquiring smaller companies. In these cases, an external threat can become an insider threat very quickly. These threats may not be detected applying advanced data analytics to system logs or behavior – there is not enough data yet. Countering that threat requires a rigorous onboarding checklist and procedure for IT assets, and personnel to identify a threat before any trend analysis would have been feasible. In this context, fundamental best security practices apply over a bleeding edge technical solution.

Contributors

* Arc Aspicio |

Arc Aspicio enhances the future of our nation by creating bold ideas and bringing them to life. A consulting and solutions company, Arc Aspicio solves problems by applying our integrated capabilities in strategy, design, data, human capital, behavioral science, and technology. The company passionately pursues our vision to be the hub of creativity where people take action to change the world. To do this, employees collaborate with clients and partners to create solutions using a human-centered approach. Innovation is not possible without action. The company focuses on strategy first, then takes a hands-on approach implementing ideas to achieve results. Join Arc Aspicio and our Strategy Innovation Lab (SILab) by creating and sharing ideas to inspire people to change the world. Follow us on Twitter @ArcAspicio @SILabDC and, #welovedogs!

Reinventing Strategy

Reinventing Strategy

Since the GPRA Modernization Act in 2010, agencies across the Federal Government have raced to establish new Strategic Plans in response to incoming Presidential Administrations and agency leaders. Developing a new Strategic Plan is incredibly exciting for an agency. Leaders can redefine priorities, frontline managers can improve mission performance, and employees can better engage with the mission. Strategy, however, is so much more than just a Strategic Plan.

Running IT Like a Business: How Technology Business Management is Shaping the Future of Federal Agencies

Running IT Like a Business: How Technology Business Management is Shaping the Future of Federal Agencies

As the Government continually looks for ways to increase efficiency and encourage innovation, Information Technology (IT) is emerging as a solution to these needs. Recent Federal guidance mandates all agencies to adopt a new framework for better understanding IT costs. Technology Business Management (TBM) is a framework that incorporates IT departments into the overall business network, shifting away from treating IT as an independent unit. This provides a clear way to evaluate and manage IT, running IT as a business and communicating the value of new IT investments.

Behavioral Science – Using Behavioral Science to Effect Action

Behavioral Science – Using Behavioral Science to Effect Action

How do organizations encourage behavior change in their customers? Increasingly, they focus on customer experience, and as a consequence employ behavioral science methodologies. At the heart of behavioral science is the consideration of how an organization can make small investments that generate incremental savings/returns while considering both customers and organizational benefits. One example is Transportation Security Administration’s (TSA) Pre✓® and U.C. Customs and Border Protection’s Global Entry programs.

Launching into #Action Through Strategy

Launching into #Action Through Strategy

As a new employee, your first company-wide meeting can make you nervous. This was how I felt.

Arc Aspicio’s recent Strategy Launch Day was so well planned and it involved participants so that I learned that I had nothing to worry about! The company treats each employee equally and equips even the newest joiners with the information and skills they need to have a meaningful experience

What Being a Consultant Means to Me

What Being a Consultant Means to Me

As a Consulting Associate at Arc Aspicio, I provide expertise and insight to help clients solve difficult problems. To be successful, a consultant does not need only to be a subject matter expert on their client’s industry and needs - though this often ends up happening over time.

Captivate Your Audience Through Design+Data

Captivate Your Audience Through Design+Data

So often, senior leaders must communicate their strategic and simple vision in a world of growing complexity. They must make decisions – and frequently explain them – based on an enterprise view of their data. It’s getting easier to do this these days through data visualizations and infographics that speak to specific employee and stakeholder audiences. Design+Data is what we call it at Arc Aspicio.

Chief Data Officers: Six Steps to Manage Data as an Enterprise Asset

Chief Data Officers: Six Steps to Manage Data as an Enterprise Asset

With an exponential increase in the types and quantities of data, organizations need defined strategies and techniques to manage data as an enterprise asset. To create enterprise-wide use of data, a Chief Data Officer (CDO) needs a clear data agenda for leadership and the whole organization to address current and future needs. CDOs should follow this six-part data plan to achieve short term capability gains and plot a path to greater enterprise data maturity.

Securing Cyberspace: Agile Strategy to Counter Changing Threats

Securing Cyberspace: Agile Strategy to Counter Changing Threats

Cybersecurity, managing and protecting computer systems from attacks, is evolving just as quickly as the techniques hackers use to cause damage. Historically, the public and private sectors believed that stronger technology and more advanced computer systems alone were enough to prevent attacks. As new trends emerge and the technologies used to both conduct and prevent hackings improve, cybersecurity strategies must remain agile, trying new tactics to counter changing threats.

Hacking Back – Do the Benefits Outweigh the Risks?

Hacking Back – Do the Benefits Outweigh the Risks?

With the increased frequency and sophistication of cyber-attacks worldwide, companies and executives are becoming frustrated with a traditional focus on defensive tactics. As a result, some private sector actors are taking a more active role in cybersecurity by “hacking back” – hacking against the very groups that are attacking their systems in retaliation or to retrieve stolen data. As hacking back rises in popularity, it is important to consider a number of political and legal issues and the risks to counter-terrorism efforts.