By: Russ Hensley, CEO CISSP
Lexington, KY
The current approach to cybersecurity is broken. In general, the public has embraced the “it won’t happen to me” mentality. In the end, the safety net is that the IT service provider or in-house IT admin is “taking care of that.”
If you are one of our clients, you have been presented with a set of quotes that we internally call our security stack. Our stack is built around the National Institutes of Standards and Technology’s Cybersecurity Frameworks (CSF). The NIST CSF is a derivative of computer security guidance that is woven into healthcare, banking and national security information security policies. Quite simply, ALL businesses should understand what these frameworks are telling your business to have in place. If your business is technology driven and if you think that there would be OUTRAGE if the business was off-line for 3 days then you should already have implemented it.
Our job is to work with our clients to provide the technical tools to help prevent intrusion. With our assistance, our clients must also invest by implementing frameworks and structuring policies. Security program recommendations for data backup policies, remote worker policies, password policy and security training program for employees are the foundation to protect your business.
Our banking and healthcare clients have lived in overload dealing with these requirements. However, many businesses in the nation pay little to no attention to the threat. Often cybersecurity services are viewed as unnecessary overhead UNTIL something happens. At that point the “overhead” is exorbitant and they realize they do not have insurance that will be needed to pay for the $100,000 or more labor bill to cover recovery, the $30,000 legal bill for their attorney’s, the $80,000 cyber forensics investigators, not to mention the media/pr control and loss of revenue while they are down. Insurance companies are not shy about letting it be known that they are reducing payouts and increasing premiums because of the lack of implementation and rise in the number of attacks.
Something needs to be done to better prevent and inspect actions that are being taken with incidents like the Colonial Pipeline ransomware attack. A single attack CAN affect the average American. “It can’t happen to me” is no longer adequate.
Fixing the approach begins with our legislators starting to understand these issues not from the nerdy intrusion and penetration hacker level, but policies being implemented and educational programs about what it is that is to be dealt with.