Former Federal CISO on the Importance of Following Through, Part 2

By Greg Touhill, CISSP, CISM, former federal chief information security officer, and guest author for the (ISC)² U.S. Government Advisory Council Executive Writers Bureau.

This is the second column in a two-part series. Read the first here. 

In the first part of this series, I discussed why I believe the vast majority of cyber incidents and data breaches are avoidable and attributed the cause of these incidents to a lack of follow through on plans, policies and procedures. I also identified several of what I consider to be bold-face items, or can’t-fail procedures, that must be executed immediately in order to help improve your risk posture. Below, I complete the list of things you should include in your follow through checklist.

Segment and Separate

Adversaries want privileged access to your information. You can reduce your risk by segmenting your network. You can shrink your risk even further by tightly controlling privileged access to your network and its information. I give extra credit to those who eliminate remote access for privileged accounts (which is a favorite exploit of certain nation-state actors).

Too many organizations have “flat” networks and give privileged access to too many people, many of whom are not adequately trained or certified. Following through to ensure you have the right architecture and skilled people in place so a single incident doesn’t compromise all of your information is a wise and necessary investment.

Harden Your Workforce

Every network user is on the cyber front lines. Limiting your cyber training efforts solely to the technical teams increases your risk. People are your greatest asset and your weakest link. “One-and-done” annual cybersecurity awareness training is not sufficient. Criminals, nation-state actors and other miscreants continue to evolve their attempts to gain access to information. Your training should evolve too. Continually hardening employees against cyber threats in the office, while mobile, or at home through innovative and interesting training is essential.  

Regularly testing the effectiveness of your training through techniques such as phishing drills and cyber games is a valuable and effective best practice that reinforces your efforts to “build quality in." Investing in educating your workforce as to the current threat environment and procedures they should follow not only reduces your risk, it also increases your sensor network while presenting potential adversaries a target much more difficult, expensive and unattractive to exploit.  

Stay Current

Plan to recapitalize your people, hardware, and software over the lifespan of your systems and make sure your plan is adequately budgeted. Criminals actively scan the internet looking for and finding old hardware and unsupported software. Antique hardware and software are easier to exploit and harder to defend. Likewise, an inadequately trained or over-tasked workforce is more likely to make mistakes and expose your information.

You need to make sure your people, hardware and software are current with the latest training and configurations for optimal operation. When making your recapitalization business case to your board and management, consider using Touhill’s Law (1 human year = 25 computer years) as you articulate why it is important to replace sclerotic old hardware and software.

Touhill’s Law is derived as follows: If you accept the adage that one human year equals seven dog years, that the average lifespan of a human is approximately 75 years, and that great technology companies like Microsoft produce a generational advance every three years, then 3 into 75 equals 25 and therefore one human year equals 25 computer years.

Can one really make the case that a 10-year-old computer system is the equivalent of a 250-year-old human? While in the Air Force, I received funding when I used Touhill’s Law to convince a fighter pilot defending his ancient computer system was the equivalent of a DaVinci glider being sent up against the latest MiG.

Plan for Stupid

People make mistakes. You have to build resiliency into your environment so that you can withstand the consequences of someone, especially a privileged user, making an error. Plan for the worst-case scenarios. Reduce the risk of negligence, carelessness, and indifference by leveraging a resilient architecture, training and engaged supervision. Create and regularly exercise specific disaster response, business continuity, back-up and recovery capabilities. Invest in training, network segmentation, privileged user management, business continuity, and disaster recovery.

Patch 

Eighty-five percent of the cyber incidents cited in the 2016 Verizon Data Breach Investigations Report were attributed to failing to patch previously known Common Vulnerabilities and Exposures. If a patch is available and you do not implement it and/or take other proactive mitigation, I believe you are not exercising due care and due diligence; neither will your stakeholders and customers. If you are a regulated or critical infrastructure entity, expect a lot of “government helpers” to arrive on your doorstep too.

Implement the NIST Risk Management Framework

Identifying your information and the risks to that information; protecting against those risks based on your risk appetite; being able to detect when that risk is being acted upon; being able to respond appropriately, and having a resilient environment that can “take a punch and keep on going” is a solid risk framework. I strongly recommend you leverage the Cybersecurity Framework as the keystone of your risk management program.

Practice

Vince Lombardi, the famous football coach, said, “perfect practice makes perfect” and kept drilling his teams on fundamentals until they achieved a routine level of perfection that made them champions. You should practice perfectly, too. Too many organizations only involve the information technology staff in exercises. That’s not good enough. The entire team needs practice, especially senior leaders. When senior leaders regularly practice, the results get closer to perfect and your follow through will too.