2022年10月20日

信息安全專業人士應該更積極的在他們的網絡安全策略,一個專家本周MapleSEC發布會上說。這並不意味著黑客或者威脅演員基礎設施後,尼克·亞曆克斯說,高級安全主任fintech Wealthsimple。相反,他說,CISOs及其等價物不得不停止反應網絡威脅。亞曆克斯是最新的主講人MapleSEC會議,由它加拿大和世界繼續今天在線。亞曆克斯說,不幸的是,大多數IT和安全領導人嚴格的網絡安全框架和測試係統不規則。采取積極的方法來建立一個安全計劃意味著預期違約將會發生。“你要有一個心態的“當”不是“如果”你要打擊,亞曆克斯強調。“反擊安全是一組簡單的五個核心原則可以嵌入和采用在你的組織中,”他說。網絡安全包括:編製一個積極的態度。“這是思考你要做什麼壞事發生,而不是試圖阻止壞事的發生。你的控製,你的人,你的策略都是一致的。”一個統一的網絡安全方法。 Too many organizations approach cybersecurity in silos, where information about threats is kept to certain departments. Not only should threat information be shared across business units, Aleks said, it should also be shared with other companies and law enforcement. All staff must be involved in cybersecurity. Start by building a security champions program from different business units and have them join the security team. They will also be part of your attack response and containment strategy. Sharing outside your organization is vital as well. “The problems you are facing today in your security program are not novel,” Aleks said. “Everyone outside your space is also facing those same issues.” “It’s not OK to hoard intelligence,” he added. “Only when we come together can fight threat actors.” —thinking in terms of Continuous Security Assurance. Don’t just implement new hardware/software/policies after an incident and expect that to fix things. Test your security controls regularly — at least quarterly — and rehearse your response to expected attacks. You don’t necessarily need to invest in a breach attack simulation tool or hire a penetration testing firm, he added. Just look deeply at your last big cyber incident. Do more than find the root cause and ensure it doesn’t lead to another compromise. A post-mortem should allow you to see how effective you were, ask how your response could have been better. “Only then will we get really good at fighting fires,” he said. —having a flexible security program. Enforcing security controls from the top down won’t always work. Instead, work with employees before they work against you. Find procedures that are most flexible, easy and simple for employees. Among other things, that will help get around shadow IT (using unapproved personal devices to connect to the corporate network). It will also empower employees and customers to work with security, not against it. Coming up with secure ways of doing something involves a conversation, he said. —and having a program that stops being the department of ‘No.’ Build trust, not fear, among employees. Report on the benefits to customers of having a strong cybersecurity program. Tags