The CISO’s New Role in Making Modern IT Work

Cybersecurity — once relegated as an after-thought to the IT department — has emerged as a key concern of the board and C-Suite, thanks to the changing nature of work and productivity. The modern business is focused on allowing users to access the data they need from any device and any location. They want to free users to work the way they are most productive, when they are most productive. And that can’t happen without proper security.

Ironically, the requirement for modern cybersecurity is why many organizations are slow to implement these innovative, new business practices. Too many IT professionals believe opening up their workplace increases their attack surface area, making it easier for malicious actors to get in. While their suspicions might be valid, it doesn’t have to be this way. In fact, when executed properly, embracing modern business innovations, such as cloud and mobility, can actually help decrease your exposure to risk.

IT professionals can do a number of things to ensure that security isn’t overlooked as new IT practices are implemented. The role of the Chief Information Security Officer (CISO) is also an important piece of the modern IT organization, ensuring the organization’s approach is aligned with IT by staying ahead of the game. This includes reducing the amount of data to be collected, considering the evolving security perimeter, focusing on protecting data rather than devices, and reducing the size of the organization’s application portfolio.

Re-consider the perimeter

Investments in perimeter security, such as firewalls, are not as effective as they once were. While protecting the perimeter should always be a component of the organization’s security, no network is impenetrable. In fact, our old idea of what the perimeter actually is no longer valid; with mobile, cloud and other innovations, your edge of attack is constantly changing, growing and harder to define. (This is why we are starting to say that “identity is the new perimeter,” because the people accessing your data are doing so from beyond the firewall, anywhere, anytime. More on that below.) The best response is to adopt an “assume breach” model. Organizations need to act as if a breach has already occurred, and put their energies into detecting, remediating and preventing future breaches.

Protect data, not devices

In the modern IT world, employees access the data from anywhere and work outside of the office, just as effectively as in the office. As a result, the most effective approach is to protect the data itself, not just the devices used to access it. If data is encrypted, at rest and in transit, your odds of breach are reduced. Blocking employees or their devices from accessing certain sites is the old way of doing business. Employees can and will find ways around those types of limitations. Instead of trying to protect every device, focus your attention on protecting critical data. Leverage encryption and other tools to protect data at rest and in motion. This allows data to be fluid and flexible, especially when combined with a modern identity and access management strategy to limit access to information to those who need it.

Reduce the application portfolio.

On average, each organization manages more than 3,000 apps, and each app creates the risk of security gaps, often around data privacy. It’s very rare that any organization really needs 3,000 apps to effectively run their business. Not only do all these apps lead to employee confusion – different user names, passwords and processes for each — but they also expose an organization to complexity and more risk. To counter this, you must start with a solid understanding of the purpose and function of each application. While you will never be able to achieve a one-size-fits-all application, pick the best ones whose purpose and function best match the needs of the organization and eliminate the rest.  Reducing the number of apps also reduces operating costs, which provides real financial gain. Just as with data, less is more.

Modern IT enables new styles of work that make a business effective without compromising data security, which can also save money and time. These practices are a good first step to ensuring a secure, modern IT.


Add Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.

10 Things You Didn’t Know about Colgate-Palmolive CEO Ian Cook
How Tyler the Creator Achieved a Net Worth of $6 Million
The 10 Biggest Life Lessons Jack Bogle Ever Taught Us
20 Things You Didn’t Know About Old Navy
The Five Best Digital Memory Stocks to Buy in 2019
Five Examples of When Paying off Debt Early is a Mistake
Reasons to Suggest The Rich Might Be Killing Social Security
Five Ways to Earn $20 Today
10 Things You Didn’t Know Google Assistant Could Do
How Three Kinds of Advanced Technology Can Impact Your Life
Retail Supply Chain: Its Evolution and Where We’re Headed
A New RoboCop-Like Exoskeleton is Helping Paralyzed People Walk Again
The Prana Superyacht is a Fantastic Way to Explore Indonesia
The 10 Best Beach Destinations to Visit in February
Five Places You Have To Visit When Vacationing on Dauphin Island, AL
10 Travel-Friendly Beauty Products for Lady Globetrotters
The History and Evolution of the Cadillac ATS
A Closer Look at The 2020 Mercedes-Benz CLA
The History and Evolution of the Chrysler 300
How Much Does a Wheel Bearing Replacement Cost?
A Closer Look at the Oris ProDive Control Limited Edition
A Closer Look at The Cartier Tank Cintree
A Closer Look at the Zelos Skyraider Watch
A Closer Look at the Blancpain Fifty Fathoms Automatique Titanium