The CISO’s New Role in Making Modern IT Work

Cybersecurity — once relegated as an after-thought to the IT department — has emerged as a key concern of the board and C-Suite, thanks to the changing nature of work and productivity. The modern business is focused on allowing users to access the data they need from any device and any location. They want to free users to work the way they are most productive, when they are most productive. And that can’t happen without proper security.

Ironically, the requirement for modern cybersecurity is why many organizations are slow to implement these innovative, new business practices. Too many IT professionals believe opening up their workplace increases their attack surface area, making it easier for malicious actors to get in. While their suspicions might be valid, it doesn’t have to be this way. In fact, when executed properly, embracing modern business innovations, such as cloud and mobility, can actually help decrease your exposure to risk.

IT professionals can do a number of things to ensure that security isn’t overlooked as new IT practices are implemented. The role of the Chief Information Security Officer (CISO) is also an important piece of the modern IT organization, ensuring the organization’s approach is aligned with IT by staying ahead of the game. This includes reducing the amount of data to be collected, considering the evolving security perimeter, focusing on protecting data rather than devices, and reducing the size of the organization’s application portfolio.

Re-consider the perimeter

Investments in perimeter security, such as firewalls, are not as effective as they once were. While protecting the perimeter should always be a component of the organization’s security, no network is impenetrable. In fact, our old idea of what the perimeter actually is no longer valid; with mobile, cloud and other innovations, your edge of attack is constantly changing, growing and harder to define. (This is why we are starting to say that “identity is the new perimeter,” because the people accessing your data are doing so from beyond the firewall, anywhere, anytime. More on that below.) The best response is to adopt an “assume breach” model. Organizations need to act as if a breach has already occurred, and put their energies into detecting, remediating and preventing future breaches.

Protect data, not devices

In the modern IT world, employees access the data from anywhere and work outside of the office, just as effectively as in the office. As a result, the most effective approach is to protect the data itself, not just the devices used to access it. If data is encrypted, at rest and in transit, your odds of breach are reduced. Blocking employees or their devices from accessing certain sites is the old way of doing business. Employees can and will find ways around those types of limitations. Instead of trying to protect every device, focus your attention on protecting critical data. Leverage encryption and other tools to protect data at rest and in motion. This allows data to be fluid and flexible, especially when combined with a modern identity and access management strategy to limit access to information to those who need it.

Reduce the application portfolio.

On average, each organization manages more than 3,000 apps, and each app creates the risk of security gaps, often around data privacy. It’s very rare that any organization really needs 3,000 apps to effectively run their business. Not only do all these apps lead to employee confusion – different user names, passwords and processes for each — but they also expose an organization to complexity and more risk. To counter this, you must start with a solid understanding of the purpose and function of each application. While you will never be able to achieve a one-size-fits-all application, pick the best ones whose purpose and function best match the needs of the organization and eliminate the rest.  Reducing the number of apps also reduces operating costs, which provides real financial gain. Just as with data, less is more.

Modern IT enables new styles of work that make a business effective without compromising data security, which can also save money and time. These practices are a good first step to ensuring a secure, modern IT.


Add Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.

George Strait concert
How George Strait Achieved a Net Worth of $300 Million
Wes Edens
10 Things You Didn’t Know about Milwaukee Bucks Owner Wes Edens
Wharton
The 20 Most Notable Wharton Alumni in Business
Bruce E Grewcock
10 Things You Didn’t Know about Peter Kiewit Sons CEO Bruce E. Grewcock
Credit cards in wallet in back pocket
7 Elements of a Good Credit Application
budgeting in the office
Three Ways Budgeting Our Money Actually Makes Us Richer
thermometer
10 Pharmaceutical Stocks to Consider in 2019
DJIA
The History and Evolution of the DJIA
Software Engineer
How to Become a Software Engineer and the Salary You Can Expect
Uptime
Prioritizing Security to Future-Proof Enterprise Collaboration
Does Artificial Intelligence Have Ethics?
Cloud Attack
Top 8 Cyber Security Trends in 2019 You Should Look out For
Seattle
20 Awesome Free Things to Do in Seattle
Downtown Dallas
20 Awesome Free Things to Do in Dallas
Four Mexican Getaways You Need to Try At Least Once
Family Friendly Vacation to Dillion, Colorado
2019 Mazda CX-9
The Top 20 Midsize SUVs for 2019
The 20 Most Fuel Efficient Cars in 2019
2013 Nissan GTR
The 10 Most Expensive Cars to Maintain in 2019
The 20 Best Chevy SUVs of All Time
Timex MK1 Steel Watch With White Dial
The 10 Best Timex Watches of 2019
Fossil Sport
The 10 Best Fossil Watches of 2019
Hamilton Watches feature
The 10 Best Hamilton Watches of 2019
The 20 Best Tourbillon Watches in 2019