The Top Challenges Facing CISOs
As a Chief Information Security Officer (CISO), it’s your responsibility to safeguard your company from cyber security attacks and compromised insider information.
But the role of CISO is rapidly changing across the board. While there was certainly a time where such a position was only found in select businesses, both the ease and modern necessity of a digital presence is regularly exposing new markets to the threat of cyber attacks.
And as CISOs become more common throughout a variety of industries, the unique challenges that this role now faces are expanding just as quickly. Below are some of the top challenges facing the modern chief information security officer today, along with a few tips on how to overcome them.
The Internet of Things (IoT)
Not necessarily the newest threat for today’s businesses but certainly one of the most quickly evolving, the Internet of Things poses a unique security risk for companies and consumers alike.
In the first half of 2017, for example, IoT attacks skyrocketed by 280% according to a new report from F5 Labs. And as it becomes increasingly cheaper to produce such connected devices, we can only assume that a higher number of less secure devices will continue to flood the market in the coming years.
One of the main concerns of this trend is the threat of more frequent DDoS attacks. Just last year, a number of high-profile brands including Netflix and Twitter were seriously impacted by the infamous Mirai botnet. What’s more, the prevalence of such attacks is expected to continue rising, that is until manufacturers are held accountable for the security of the products they put out.
As CISO, this growing threat brings with it the necessity of implementing new security measures to remedy the unique vulnerabilities of these devices. Conducting regular and frequent device audits, ensuring all connected equipment is included in enterprise logging solutions, and immediately changing default factory settings are just a few of the best ways to prevent a potentially devastating attack or breach.
Ransomware
One of the biggest cyber threats today is ransomware. Earlier this year, an enormous and global ransomware strike called the WannaCry attack affected thousands of systems across countries like Russia, Spain, the United States, and France.
The attack points to the growing prevalence of ransomware incidences in the commercial sector and demonstrates that such attacks are becoming more organized, sophisticated, and frequently carried out.
In addition to the growing prevalence of these attacks (which occur once every 40 seconds in fact), the variation of the ransomware software itself is increasing at a breakneck pace as well. In fact, there were 4.3 times as many new ransomware variants in the first quarter of 2017 compared to a year earlier.
With most ransomware attacks (and with WannaCry in particular), the leading factor that contributed to a vulnerable system was outdated software and equipment. Most CISOs worth their salt make regular updates an integral part of their business processes but doing so even more diligently may mean the difference between a blocked attempt and a five-figure disaster.
Increasingly Burdened Networks
From phones, watches, and laptops to security cameras, refrigerators, and thermostats, never before now have there been so many connected devices throughout a workplace. While many of these devices bring with them a host of benefits like greater productivity and streamlined communication, each addition to your business’s network puts just a little bit more strain on the system.
What’s more, software and version upgrades, new applications, and an increasingly connected workforce means that your company’s bandwidth is only going to be tested even more with each passing year.
Regularly upgrading your network and utilizing network bandwidth maximization techniques as a CISO is one of the best ways to ensure your business is able to handle this influx and keep your company from going dark on your watch.
Non-Traditional Payment Systems
The way consumers are paying for goods and services is changing fast. Whereas online credit card transactions were some of the main targets of malicious hackers several decades ago, they’ve now set their sights on mobile payment systems such as Apple Pay and Google Wallet.
While mobile payments are certainly growing in sophistication and security, the majority of the population still thinks that this method is built on shaky ground. For instance, almost half of security experts surveyed in an ISACA study claimed that mobile payments aren’t secure and 87% expected to see an increasing number of mobile payment data breaches in the future.
It’s also important to realize that the only thing at stake here isn’t just payment information. Knowledgeable cyber terrorists can use a compromised mobile payment system as an entry point to access other sensitive data like intellectual property, contacts, applications, and other classified business material as well.
The takeaway here is to be exceedingly careful with these systems and avoid using non-established payment companies just to save a dime.
Phishing
While putting in the time, effort, and resources necessary to build a complex and advanced cyber security defense system is certainly worth the expenditures, there is one type of threat in particular that’s especially difficult to combat – phishing.
Just as with many other problems facing the tech industry today, human error is one of the top contributors to a compromised system. It’s your responsibility as CISO to implement training procedures to keep your company’s employees informed about their roles in information security because phishing scams are becoming even more convincing (and dangerous).
The Increasingly Important Role of CISO
As malicious malware, cyber attacks, and phishing scams become even more prevalent in the coming years, it’s absolutely critical for CISOs to stay on top of the latest trends in cyber security and to implement measures to prevent and combat such attacks should they occur.
Combining a proactive approach to cyber security and an effective and comprehensive incident response plan are two keys to ensuring your company can make it in the digital age.
