ESET Shares 5 Basic Cyber Security Lessons for Businesses

ESET, Europe-based leader in IT security, shares five basic cyber security lessons from its experts. Dave Maasland, CEO Eset Netherlands in cooperation with Fred Streefland, IT Security Manager at LeaseWeb, explore a new way of looking at cybersecurity that stops viewing it as a goal in itself and instead as something that is directly connected to business needs. As it stands now, it seems that too many security organizations are missing the mark.

More often than not, Information Security and Cyber Security conferences are flooded with relatively ‘new’ developments such as Next-gen, IoT (Internet of Things), IoT DDoS, Security Intelligence Platform, et cetera. The fact that some of these terms have become ‘hype’ is not in itself a problem, but it makes one wonder whether the security world may be looking at things in the wrong way and thereby missing the demands that need to be addressed.

Lesson 1: Start with the business (and its risks)

Security can be exceptionally complex, but its essence is quite simple. Security is nothing more than reducing or taking away risks, and making them visible so that the business can accept them and continue doing its work – nothing more, nothing less. To do this as effectively and efficiently as possible, security people have to understand the business and not see it solely from an IT perspective but from the broader perspective of the business itself. When starting from the business, they first have to identify, map, and categorize the risks of the specific business. Second, they need to determine, together with the business itself, which risks need to be dealt with and in which order. When that’s done, the person responsible for the security within the company has to set up a security plan that describes how these changes are to be executed. In doing so, there has to be clear goals and deadlines. Ideally, this should be done in a ‘smart’ way, one step at a time, so as not to engage in too many projects at once.

Lesson 2: Determine a security roadmap with a clear goal, step by step

Defining the security approach (or security roadmap) is essential and should be discussed with the business on an ongoing basis to make adjustments where and when necessary. During the creation and execution of the roadmap, the projects that are defined will all contribute to the reduction of risks and achievement of the end goal. It’s important to not lose sight of the business goals, because the people responsible for security shouldn’t ‘restrict or obstruct’ the business with security measures. It’s not rocket science, and shouldn’t be treated like it is. The creation of a plan should be something that everyone, even without IT skills, can understand. Of course IT plays a role, but only at the last moment when IT solutions are needed for the execution of the security projects.

Lesson 3: Cover the basics before implementing more advanced security solutions

Most organizations don’t even have basic security measures in place, let alone advanced security solutions. Security company presentations on these technologies often look stunning and offer interesting content, but they are simply too advanced for most companies. Furthermore, experience shows that the most hacks (about 90%) are still using the simplest methods and weaknesses: phishing emails, malware attachments, etc. And, of course, there is the weakest link of all: the human being.

Companies need to create basic security solutions for these simple risks first before they turn their attention to more advanced technologies. Of course, these are important as well and they should be implemented in the future, but only after the basics are fortified. Often during security congresses there is a focus on sophisticated threats and APTs (advance’s persistent threats), but companies such as TalkTalk and Ashley Madison might have been protected from attack if even basic security was in place.

Read more: ESET Shares 5 Basic Cyber Security Lessons for Businesses