by Rebeca | Aug 3, 2022 | cybersecurity, Definitions, News, Resources
The company of today, both private and public, face a daunting variety of threats to cybersecurity. A cyber attack can threaten the very existence of an organization. And even the jobs of some of its C-suite officers. But the response doesn’t rest solely on a building a better technical solution: we need to create a cyber-secure culture.
Given the overwhelming reality of the resources and time already being devoted to a company’s security strategy, an important question arises:
How can organizations begin to realistically embed security into the DNA of an enterprise?
In this sense, Research by the Centre for the Protection of National Infrastructure (CPNI) made a suggestion. That multiple interrelated factors need to be considered when attempting to change an organisation’s security culture.
Cybersecurity company : what is “security culture”?
Contrary to what most think, it is the ideas, customs and social behaviors of an organization that influence its security. It is the most important element in an organization’s security strategy.
And for good reason: The security culture of an organization is foundational to protect information, data and employee and customer privacy.
In the first place, not all people learn in the same way. For that reason, every organisation and every audience is different when it comes to learning. In this case, we believe that a human-centred approach to security, using high impact interventions, can accelerate positive security culture change.
During the pandemic, some industries and organizations have seen their security cultures stagnate or decline. As many organizations transitioned to a work-from-home model, new security concerns emerged. For that reason, the communication and education becoming somewhat more challenging.
How to Support A Strong Security Culture
There are some practical steps organizations can take to develop a strong security culture across seven distinct dimensions:
- Attitudes: Employee feelings and beliefs about security protocols and issues.
- Behaviors: Employee actions that impact security directly or indirectly.
- Cognition: Employee understanding, knowledge and awareness of security issues and activities.
- Communication: How well communication channels promote a sense of belonging and offer support related to security issues and incident reporting.
- Compliance: Employee knowledge and support of security policies.
- Norms: Employee knowledge and adherence to unwritten rules of conduct related to security.
- Responsibilities: How employees perceive their role as a critical factor in helping or harming security.
With this in mind, view the Strategic Cybersecurity Skills
In that case, we can help you build a solid security culture in your organization, let’s talk?
Sources:
(1) Forbes
(2) Security Magazine
Picture: Foto de antivirus creado por rawpixel.com – www.freepik.es
by Rebeca | Jul 19, 2022 | cybersecurity, News, Resources
Evidence suggests there is a global cybersecurity skills shortage affecting businesses and governments alike. Which means that organizations are struggling to fill their cybersecurity vacancies.
With the volume and severity of breaches in recent years, it’s unsurprising that businesses are now recognising the risk. As a result they begin to respond accordingly.
In fact, global security spending is predicted to reach $1.75 trillion by 2025. To many, this might seem like a positive step – but we need to consider where that money is going.
A very common tactic adopted by organizations is to throw money at the problem. But it’s proven to be ineffective and can end up making the problem worse. By deploying hundreds of disparate security products to tackle individual weaknesses, the business can become overwhelmed. At the same time, teams will miss the bigger picture.
The importance of workforce
Security awareness training usually takes a fixed approach where one cyber threat is tackled at a time. Workers are not taught to defend the company from threats. Instead, they train themselves with multiple-choice questions that they can easily forget.
It bears no relevance to the role these workers will play in the midst of a crisis. And treats them like vulnerabilities – not defensive assets.
Each member of the workforce has value to add. So instead of these outdated and ineffective methods, organisations need to focus on three simple factors. With this in mind, they can develop the cyber capabilities of their entire workforce. Those factors are: exercising, evidencing and equipping.
In other words:
- continually benchmark the knowledge, skills, and judgement of the workforce;
- demonstrate risk levels across all business functions by using data gathered from simulations;
- and use regular cyber exercises to plug any skill gaps. These criteria are critical.
New strategies needed to close the cybersecurity skills gap
Cyber security challenges will only become more complex, which means we need to be proactive. It takes time to educate and train highly skilled professionals, and time to gain practical working experience.
If we are going to realistically meet these mounting challenges, we must find ways to bridge the cyber skills gap.
By casting our nets wide and leaving no stone unturned, we can build a workforce that is capable of meeting the cyber security challenges of tomorrow.
See how Soffid can help you stay ahead of the curve in a rapidly evolving digital world. Share your requirements and a representative will follow up to discuss how Soffid can help secure your organization.
Sources:
(1) computerweekly.com
(2) cybereason.comPicture:
Foto de concepto creado por Waewkidja – www.freepik.es
by Rebeca | Jul 14, 2022 | cybersecurity, Definitions, News
Passwords are designed to give you access to an online world while companies protecting your information. However, password security can lead to attacks. This first point of cybersecurity is becoming a weak spot that can involve dire consequences if unaddressed for companies.
Relying on passwords for security has become increasingly problematic. Devising and remembering a complex password for every account and website is virtually impossible on your own. But using weak and simple passwords is a recipe for data breaches, account takeovers, and other forms of cyberattack.
Password security and Reports tell us about the situation…
For its report The misfortunate passwords of Fortune 500 companies, NordPass researchers analyzed data from public third-party breaches that affected companies. The data included details from more than 15 million breaches across 17 different industries.
The researchers looked at the top 10 passwords used in each industry. In addition the percentile of unique passwords, and the number of data breaches that hit each sector.
The word “password” is still being used, and misused as the most common password across all industries. Including retail and e-commerce, energy, technology, finances, and even IT and technology. Among other passwords in the top ten list, some common choices were “123456,” “Hello123,” and “sunshine.”
According to a Verizon report, more than 80 per cent of data breaches occur from weak or compromised passwords. Because creating the likelihood of an ongoing vulnerability regardless of how much technology is deployed to defeat hackers.
Certified cybersecurity. Multifactor authentication
Education and awareness are becoming more crucial in cyber security, especially in SMEs.
Two-factor authentication is great but you need to educate people about it because most employees complain about it.
The term “two-factor authentication” refers to a second step to confirm who you are. An additional layer of protection will, by default, provide more security than a single barrier.
The easiest way to “lock the door” on technology is employing multi-factor authentication. This security measure requires users to present at least two pieces of evidence before gaining access to a server, device, database or software program. A cybercriminal who has obtained a user’s username and password will not be able to access the system. You would still need to have access to that person’s unlocked cell phone or email to get an urgent verification code.
Especially, to avoid Data Leaks on Social Networks.
See how Soffid can help you stay ahead of the curve in a rapidly evolving digital world. Share your requirements and a representative will follow up to discuss how Soffid can help secure your organization.
by Rebeca | Jun 22, 2022 | cybersecurity, News, Resources
With so much of our personal information available online, criminals no longer need to go through our trash cans for important documents. For this reason it is essential to protect your digital identity.
For many years, destructive attacks have been studied and documented. Especially those that are done for financial reasons where cybercriminals demand payment to decrypt the data and restore access.
Yet despite attempts to stop this threat, ransomware continues to impact organizations across all industries. Additionally, it significantly disrupts business processes and critical national infrastructure services and leaves many organizations looking for better protection.
Organizations that continue to rely on legacy systems are especially vulnerable to ransomware threats. As these systems may not be regularly patched and maintained.
Key ransomware prevention and mitigation considerations for business and IT leaders
As you plan for a comprehensive defense posture against ransomware threats, here are some key questions to consider:
- How are you defending your organization’s data, systems and employees against malware?
- Are your organization’s systems up to date and patched continuously?
- Are you watching for data exfiltration or other irregularities?
- What is your comprehensive zero trust approach, especially strongly authenticating my employees when they access information?
- Are you taking the right back ups to high assurance immutable locations and testing that they are working properly? This should include testing that does a periodic restore of key assets and data.
- What drills are you conducting to battle-test your organization’s risk management and response to cyber events or incidents?
How cyber security can protect your digital identity
Every time you do something actionable online, like access your social media or sign up for an email subscription, your digital identity grows. This information says a lot about you, so protecting it is crucial.
In the digital age, it’s nearly impossible to avoid having your personal information online. This makes it critical to protect your digital identity. By watching out for phishing scams, protecting your information and securing your accounts, you can stay cyber safe and help defend yourself against digital identity theft.
The use of a secure and robust digital identification system that is capable of protecting privacy is an essential, reliable and user-friendly element for a strong cyber resilience strategy and is a source of new business opportunities and applications for banks, private sector with a return on their investment.
Convergence
Traditional approaches to IAM, which reflect an era when devices were centrally managed and business applications resided behind the enterprise firewall, are becoming increasingly anachronistic. In a post-COVID, post-perimeter world, identity has become the first line of defense. The inevitable result of this trend will be the convergence of identity and risk.
Conventional IAM architectures have relied primarily on the ability to authenticate user credentials to a directory store and grant fine-grained access to business applications on the basis of statically assigned privileges, regardless of any inherent risk posed by a user. This model no longer reflects an IT landscape in which a mobile workforce can use unmanaged smart devices from anywhere in the world to access sensitive data in cloud-hosted business applications.
The new proposal for IAM solutions, as Soffid are, need the ability to evaluate inherent and contextual risk when granting access to sensitive data and applications.
Picture: Foto de malware creado por DCStudio – www.freepik.es
Sources:
(1) Security magazine
(2) Forbes
(3) getcybersafe.gc.ca
(4) securityboulevard
by Rebeca | Jun 15, 2022 | cybersecurity, Resources
Converged IAM is the future of IAM because the digital transformation of enterprise and government continues to gain speed.
The adoption of measures to mitigate intangible risks against visible and immediate corporate requirements are limited. Significant gaps are ever-present in the assessment, management and operations surrounding risks arising from converged security.
Asset-intensive industries, are generally at risk with the proliferation of industrial IoT and legacy systems interfaced to their IT networks. Especially those within a critical infrastructure setting such as power, water or transport.
To assist organizations in risk management, must work with skilled professionals who can deliver a framework for integrated security governance.
Digital transformation
Digital transformation delivers many benefits to organizations including greater efficiency, cost-effectiveness, and the agility to respond to changing needs.
But it also delivers challenges in the form of dispersed data warehousing. Así como también el uso de servicios públicos que no controlan completamente el grupo de TI de la organización, y una proliferación de aplicaciones únicas para administrar y monitorear.
How can companies bring their digital visions to reality when their people, data and infrastructure are moving outside of their control?
Converged IAM
Organisations need a heightened focus on the protection of both their own and customer information to ensure business sustainability and to retain customer trust. Converged IAM is indeed the future of IAM. It’s only a matter of realizing this importance and educating stakeholders to ensure organizations are better equipped to handle today’s sophisticated threat landscape.
As we mentioned in our post a few months ago, Converged Identity and Access Management (CIAM) unifies disparate physical and logical access control systems to create a singular trusted identity and credential to match rights and access them across the enterprise.
CIAM is born out of growing customer demands. The gist of these demands are quite consistent: quick, reliable, and trustworthy service. Furthermore, customers want seamless, no-fuss experiences.
Security must be like a living organism that can adapt to global risks and increase or decrease security as the threat landscape changes. The level of security, of course, can impact friction with employees, so it is important that during normal operations the security controls have zero friction and visibility for employees. This ensures usable security and increases the effectiveness of controls.
Here, an interesting information from KPMG about the future of identity and access management
Sources:
(1) KPMG
(2) CSO Online
(3) Security Week
Picture: Vector de cyber seguridad creado por WangXiNa – www.freepik.es
