CISO’s Playbook for Leading Security During COVID-19

On this special edition of the Futurum Tech Podcast - Interview Series, host Daniel Newman welcomes Mark Hughes, Senior Vice President of Security at DXC Technology to discuss the CISO’s playbook for leading security during COVID-19.

The Current Cybersecurity Landscape

Cybersecurity challenges and threats are not getting any better or easier to manage. CISOs confront new threats, new threat actors, and new strains of malware and ransomware constantly. We used to be concerned with confidentiality attacks where information was being stolen, but now there is an increasing escalation in targeted attacks like ransomware.

To deal with these threats, most companies are spending just enough money to have the framework to stop the most critical attacks. But many companies aren’t overspending on security to be safe. There are trade-offs between the risk-based decisions, but there are two things that are definitely true in the cybersecurity landscape right now.

1. A lot of risks come from malicious intent, but not all so organizations need to be prepared on all fronts.
2. Threats and risks appear very quickly. Many organizations can be secure one day and under attack the next.

CISOs are in a balancing act. They need to mitigate risks as quickly as possible while making sure that the organization is as secure as it can be with a limited budget. It can definitely be tricky.

New Challenges with Remote Work

Almost overnight, CISOs faced a whole host of new challenges as entire companies moved to remote work as a result of the pandemic. Until now, many companies had a few groups working remotely or were prepared for people to work from their own devices while traveling. They only had a small scale set up to manage little pockets of people, but now companies and CISOs have to do this with the whole organization. The job of a CISO got extremely complicated in the matter of a few days. Every CISO was now asked if the company had the scale and infrastructure to handle this new situation. And if they didn’t have the scale, CISOs needed to come up with a solution — and fast.

The second question many CISOs faced was can the security tools operate effectively in the new network environments we are now operating in. Are there particular groups that pose the highest level or risk that need access to critical tools? How do you layer security in a work from home environment so you can manage risk proportionately without hindering productivity?

Managing Security Risks

Companies have SaaS solutions, open source solutions, open stack, public clouds, private clouds, and a host of other initiatives and programs in use to help employees be productive. But each new program or solution adds a layer of complexity to security. And as much as a CISO might want to, putting stringent security protocols in place isn’t always the answer.

It’s a balance between four things: people, process, physical control, and technical control. CISOs need to educate people on the role they play in security. They need to help people understand the process of security. Then there needs to be physical and technical security controls in place that are manageable.

If you try to skew your strategy to only one bucket, like the technical aspect, users will figure out workarounds. But if you make sure that people know that security is the thing that needs to be done everywhere, by everyone, at all times, you’ll find more success. Education, however trite it may sound, is key. 

If you do this well and do it consistently, you can massively improve your risk posture making a big difference very quickly.

If you’d like to learn more about managing your security risk and ways DXC Technology can help, check out their website. Be sure to listen to the full episode below and while you’re at it, make sure to hit subscribe.