Cybersecurity Policy

1. How should we approach the development of cyber-policy and -infrastructure given the “short arm” of predictive knowledge?

Businesses in the United Kingdom were targeted 7,073,069 times in January 2018. The US Department of Homeland Security notified 247,167 of its workers on January 3, 2018, that their data had been compromised.

Implementing the most effective technology is one strategy to improving cybersecurity, but such technologies are only as good as the organizations and individuals that use them. As a result, CIOs and CSOs must prioritize policy development and implementation. Below are methods for establishing strong cybersecurity rules and procedures.

1. Update software and systems

Following the Spectre attack in January 2018, Apple released security updates for its iOS 11 operating system. This is similar to what other IT suppliers do when they find a security flaw. However, the challenge for IT is ensuring that the variety of devices in consumers’ hands are all updated with the most recent versions of a slew of operating systems. This necessitates centralized policy creation in IT, which will most likely use a ‘push’ methodology, which forces new security updates onto a user’s device when they connect to the network, rather than a ‘pull’ methodology, which notifies the user that a new security patch is available and gives them the option to load this new software when it is convenient.

2. Conduct security audits from top to bottom.

If your organization hasn’t previously, it should do a thorough security assessment of its IT assets and policies. This audit will look at the security procedures and policies of your core IT systems, as well as those of your end-user departments and at the ‘edges’ of your organization, such as automated machines and IoT at remote manufacturing facilities. The audit should look not only at the software and hardware approaches you have in place to preserve security, but also at remote site staff behaviors and compliance with security standards.

3. Do not overlook social engineering.

Social engineering should be included as part of your end-to-end IT assessment, which examines if your staff are vulnerable when it comes to providing private information.

This social engineering may be as easy as someone yelling a password to a coworker over an office partition – or it might be a user who brings up a website at work and surrenders passwords or other crucial information that eventually ends up in the wrong hands.