SecurityBrief New Zealand - Technology news for CISOs & cybersecurity decision-makers
Story image
Addressing cybersecurity transparency for stronger protection
Wed, 20th Sep 2017
FYI, this story is more than a year old

Security firm Aleron says that cybersecurity management is a complex problem and transparency can result in even more ambiguity.

Because every organisation uses different processes to security, this can result in inefficiencies and weaknesses, the company says.

If organisations are to stop attacks, they need to have clear views of the threats they face and the ability to develop risk mitigation strategies.

“Two things are happening every day: new cyberattacks are launched; and new tools and solutions to combat cyberattacks are introduced. The rapid pace at which the threat landscape is evolving makes it difficult for senior managers to know if the company's investment in security is effective,” comments Aleron director Alex Morkos.

“On top of that, there is often disjointed communication between security teams and senior leaders. This is partially because highly-skilled cybersecurity professionals often lack sophisticated business communication skills.

According to Aleron, there are five key challenges to achieving transparency:

•  Getting a clear picture of the cyber threats they face  •  Understanding if their investment in cybersecurity solutions is effective  •  Making well-informed cybersecurity decisions that meet the organisation's overarching objectives  •  Accessing the skills and resources needed to effectively protect the organisation  •  Managing security governance and compliance.  “Cybersecurity is a boardroom problem, yet information about cyber risks is not delivered as transparently and as clearly as it could be to that senior level, thus hindering board members' understanding and ability to respond appropriately. To combat this problem, organisations need to find a better way to communicate the risks internally and respond appropriately,” Morkos says.

Organisations should consider choosing systems that allow accurate and simple views of the current risks, as well as ones that detail which risks businesses should focus on.

The company says that organisations must invest in tools and systems that also help them understand security risks, self-asses and gain quick insights into their security options.

Compliance tools can also accelerate problem identification, saving businesses time and money before an attack strikes.