In previous years, Cylidify has done a ramp up to NCSAM with weekly blog posts supporting that year's theme. This year, we are doing a retrospective to reduce your distractions and because we think it is safe to say that everyone is aware in regard to cybersecurity (and privacy). The global pandemic has made us hyper-aware of risks and required triaging of personal and business priorities. Unfortunately, this situation has created opportunities for attackers who have responded with new and refactored approaches. As business scramble to support remote working and employ more virtualizations, new gaps and integration "seams" are created for attackers to leverage. The difficulty this year has been to match that attacker's pace while still servicing the other business priorities — translating awareness into preparedness. Security and privacy resiliency and agility are more important than ever; and are being frequently tested.
The theme of this year's NCSAM was "Do Your Part. #BeCyberSmart" with weekly topics all related to connected devices:
If You Connect It, Protect It
Securing Devices at Home and Work
Securing Internet-Connected Devices in Healthcare
The Future of Connected Devices
This is timely and interesting given the large and extended business networks created by remote working and the continued proliferation of IoT and personal devices on business networks. However, we wanted to see more details especially for the first two week's topics. Cylidify will work to provide those details (either via references or our own blogs), but we wanted to pass along the following general guidance for working with extreme agility — as is required in the context of a breach or the unprecedent amount of change in 2020:
Be diligent about awareness campaigns, training, and overall preparedness. Create training repositories that can be self-service, encouraging staff to meet yearly requirements opportunistically throughout the year (versus shoehorning it all into December or January). Phishing campaigns, procedural dry-runs, and incident simulations can provide more structured reinforcement on practices and heighten awareness throughout the year.
Keep change tracking, risk registers, and backlogs current. When working with extreme agility, or any situation were frequent triaging is required, it's very easy to lose track of changes and accrued risk. The backlogs get stale and blind spots are created which attackers are happy to leverage to their advantage.
Increase agility and compress frequencies. Where you may have done yearly auditing and prioritization, move these to quarterly or even monthly to make sure any gaps/seams and new threats are being considered and addressed.
Whether you need Cylidify for guidance or to help solve a specific problem, we are ready! Contact us for a free consultation.
