Cyber networks are becoming complex. The increasing complexity makes the system more vulnerable to cyber threats. Data and cybersecurity breaches have increased by 67% since 2014, as the 2019 Cost of Cybercrime Study by Accenture and Ponemon Institute reveals.

Cyber networks grow complex owing to several reasons, none of which will go away soon, such as the spurt of digitalization, as a fallout of the COVID-19 pandemic, forced haphazard technology adoption. Work pressures give rise to shadow IT, often invisible to enterprise IT. The sheer volume and velocity of data owing to mobility and IoT subvert enterprise IT. To make matters worse, cybercriminals keep on developing new attack strategies.

Smart enterprises strengthen their cyber risk assessment and management strategies. But securing networks is easier said than done, owing to the complexities mentioned above. Here are five ways to manage the IT complexity and undertake effective cyber security risk assessments.

1. Strive for Simplicity

Any cyber risk management programme starts with a risk assessment or identifying the risks. A comprehensive threat assessment makes explicit the threats likely to compromise the network. It ranks threats in severity and immediacy, allowing enterprises to prioritize remediation.

• Undertake a comprehensive inventory of IT assets periodically. Identify all digital assets. Delete duplicate technologies and files. Integrate or replace standalone solutions in favour of cross-system applications.
• Identify and eradicate data silos, unless data protection mandates such silos.
• Check the integrity of new systems before integration. Many enterprises grow organically or go through mergers and acquisitions. In most cases, they become saddled with a hodgepodge of legacy IT systems teeming with vulnerabilities. Consider Marriott, which reported a massive data breach a few years ago. The breach began years earlier at Starwood, a chain Marriott acquired. The attackers had gained access to the Starwood guest reservation database. When Marriot merged the database with its reservation system, the hackers could access the entire network.
• Strive for transparency. A unified security posture detects data breaches early. In a siloed system, with poor transparency, the breach may not become visible until it is too late. About 56% of IT managers get information about a cyberattack after 60 minutes of the breach. By that time, it may become a case of lacking the barn after the horse has bolted!
• Deploy integrated tools that offer a bird’s-eye view of risks across the IT infrastructure. Multiple function-specific tools lead to redundant features and are cost-intensive. Armis offers a unified solution that simplifies network visibility. A simple yet comprehensive asset inventory management capability offers 100% visibility into assets. The device knowledge base assesses behaviour and vulnerability and classifies each device.

2. Integrate Security into the Design

To resolve complexity, integrate security into the operational design framework and the workflows.

• Automate basic security filters. Routine tasks such as password reset requests and patching systems overwhelm most IT teams. They have little time to focus on security. Automating and self-service options frees up IT staff for higher-value tasks.
• Develop a cyber-security risk management framework. To keep it simple, base the framework on industry standards, such as NIST CSF, ISO, PCI DSS, or NIST framework.
• Develop an incident response plan for all eventualities. Assign specific responsibilities, as in who needs to do what on detecting a threat.
• Armis offers granular device details and behavioural insights in real-time. It enables faster, more effective detection and response. Continuous passive tracking with automated policy enforcement safeguards the environment from most threats.

3. Customize the response

A one-size-fits-all approach rarely works in cybersecurity. Each enterprise is unique concerning the threats they face. Applying best practices blindly often turns counterproductive.

Custom-build the security stack after evaluating the risks and the implication of each risk factor.

Prioritize the distinct threats facing the enterprise, depending on:

• The financial and other implications of the threat
• Probability of the risk coming to pass.
• The risk appetite of the enterprise.

4. Ring-fence critical data

No enterprise can afford to throw unlimited resources at cybersecurity. Protecting against all possible cyber risks is impossible. Prioritize risks in terms of probability and impact.

• Keep track of enterprise data. Identify the source and location of data, and classify it according to its importance and sensitivity. Ring fence critical data with additional safeguards. But configuration changes and changes to access settings can happen at any time. Monitor activity around sensitive data continuously.
• Set up alerts for anomalous behaviour centred on sensitive data. End suspicious sessions immediately.

An agentless, passive device security platform such as Armis breaks through barriers and eliminates network blind spots.

5. Involve the Workforce

Many enterprises consider cyber security as a technology issue rather than the concern of the wider workforce. With such an approach, enterprise IT throws money into deploying technology and making short-term fixes. Comprehensive security depends on a strategic approach involving all enterprise stakeholders.

Share information on cybersecurity risks across the enterprise. The onus is on IT to provide line-of-business leaders with risk information on their roles.

Educate rank-and-file employees on cyber threats and basic security hygiene. Offer them ownership of the security protocols in their domain. Offer training on:

• Basic cyber threats and security hygiene, including safe internet habits and clean desk policies.
• How to identify malware, phishing emails, and other social engineering attacks.
• Action to take when faced with malware or other threats.
• Data management and privacy, especially awareness on the type of data to share and not to share.
• Password security, BYOD policies, and other aspects of the company policy and security strategy.

Establish a security-centric culture. Make sure everyone, from part-timers to freelancers, and from the front-line staff to the C-suite, embraces it.

Armis offers powerful solutions that automate cybersecurity asset management and aid the workforce in safe working.

The 2019 RadwareGlobal Application and Network Security Report pegs the average cost of a cyberattack at $1.1 million. Over one in three companies also face a serious loss of reputation following the attack. Data volumes and the complexity of IT systems will continue to grow, making systems even more susceptible to cyber-attacks. Deploying a comprehensive cyber security tool such as Armis that leverages the power of simplicity helps enterprises gain asset visibility and manage complex networks with ease.