The key pillars of strong cybersecurity strategies

Cybercriminals are using sophisticated tools and techniques to exploit vulnerabilities detected.

They use a variety of tactics to gain access to critical corporate assets and data.

These cybercriminals are using sophisticated attacks to steal anything from valuable intellectual property to sensitive, personally identifiable, and financial information.

They invest the time and resources required to breach their target's defences.

As such, a Cybersecurity Strategy is imperative for a mature security presence in order to improve the chances of surviving current and future cyberattacks.

It should be built around the following pillars:

1. Business and risk-driven. The Cybersecurity Strategy should aim to transform and mature the overall security position of the business at an enterprise level.  
2. Built on a well-thought financial investment model that delivers both tangible and intangible return on investment to the organisation (ROI). Abacus CFO Jonathan Bohrer points out that "If you are not a cyber geek, it can be very difficult to tell the difference between the good stuff and the bad stuff until something bad happens. Therefore, it's very important to be able to clearly illustrate the ROI of any cybersecurity project to your CFO so he or she can rationalise the level of spending that good security requires". He also says that he is often amazed at the amount of capital expended on high-end security appliances, with little thought of how those tools will be managed once installed.  
3. Woven into the organisation's culture from governance to operational levels. Caveats for continuous security awareness and security workforce sustenance are critical to a successful strategy.  
4. Frictionless and simple. The Cybersecurity Strategy set a tone for delivering simple and robust platform-based security architectures that enable the organisation to deliver great customer and user experiences. Complexity is the enemy of security.  
5. An enabler of innovation. The Cybersecurity Strategy must support digital and technology improvement initiatives.  
6. Adaptable and scalable. The Cybersecurity Strategy must be able to meet changing requirements and work across a broader range of other frameworks such as Agile or DevOps. Support the convergence between legacy services, multiple clouds, APIs, IoT, data, networks, applications and people securely.  
7. Data-driven and continuous deep visibility. The Cybersecurity Strategy must be able to proactively identify, learn, detect, prevent, react and contain security threats and attacks. Central to any future-looking strategy is its ability to harness data analytics and to be able to orchestrate across the application, network, data, microservices, identity, cloud, end user, things (IoT), as well as at integration points with third parties to ensure deep visibility and patterns.  
8. Resilience. Breaches are inevitable, however, strategies that deliver layered and quick learning security capabilities and processes will position an organisation to better prevent, react and contain cyber-attacks in a more timely way.  
9. Identity and Access management (IAM).  Automatic and passive connectivity between people, things and services is pushing the barriers of traditional identity management. Identity and access management is the new frontier of security so that security strategies should focus on putting in place capabilities that transform the organisation's traditional IAM technologies and processes. They must adopt new ways of continuous identity, governance and management, using automation, monitoring across the multi-cloud, applications, data, people, microservices and IoT environments.  
10. Continuous assurance and compliance. As privacy and data security continues to become agenda items for policy makers, the regulatory arena is becoming more stringent. We are most likely going to see more laws and regulations in the immediate future. Security leaders must focus on building security strategies that move away from the conventional tick-box approaches, to putting in place risk-based continuous assurance, and compliance frameworks which bridge across the people, services, process and technology domains.  
11. Trust and privacy. Losing consumer trust is costly. In an age where consumers are increasingly becoming more aware of the importance of data security and privacy, security leaders must ensure that they build strategies to help build continuous trust with customers and supply chain partners, in ways that translate to better customer experiences, loyalty, and revenue streams.