Practical Cybersecurity: A Roadmap for Your Business

You can’t protect what you can’t see, and the first step to creating a solid cybersecurity framework in the threat management lifecycle is about making sure you see into every corner of your organization. You’ll identify your assets, their risks and vulnerabilities, their priority levels and, finally, your specific plans to protect them.

Before you can begin to make those plans, you have to know what apps you’re running and on what devices, how your network is structured, what data you’re using and storing and how your users are accessing it all. You have to know the risks associated with each asset and prioritize those assets so you can manage risks accordingly.

The success of your cybersecurity framework strategy relies on comprehensive testing and planning. The objective expertise of a third-party vendor can be valuable at this stage, especially when it comes to uncovering your blind spots. Consider exploring your options for risk management, internal and external security testing, compliance consulting and virtual CISO (vCISO) services.

Protecting your organization is an ongoing and multi-threaded effort. Taking a risk-based approach is key to bringing your routine threat management activities to life, as documented in your cybersecurity framework policies and procedures.

For some organizations, these ongoing action items are more than can be managed with in-house resources. Despite best efforts, critical activities can fall through the cracks, leaving gaps in your cybersecurity strategy. As a result, businesses of all sizes often turn to security services providers to augment the capabilities and capacity of the security team. Consider outsourcing security testing and controls validation activities such as penetration testing, vulnerability management and application security testing.

Organizations with even the strongest security controls and cybersecurity frameworks can be compromised, but the faster a security incident can be identified and contained, the lower the costs associated with it. Bad actors such as ransomware groups can have your systems encrypted within an hour of gaining entry.⁵ That’s why detecting incidents as soon as possible is crucial. 

Unfortunately, it can take months to detect and contain a breach. According to the 2021 IBM Cost of a Data Breach report, it takes 287 days on average – 212 days to identify a breach and another 75 days to contain it. A breach with a lifecycle over 200 days costs an average of $4.87 million versus $3.61 million for one with a lifecycle of less than 200 days, representing a difference of almost 30%. The differences in impact are substantial when you can detect and contain a threat in minutes versus hours, days or even months. ⁶

According to recent research, smaller organizations are less likely to detect breaches in a timely manner than larger ones. Regardless of the size of the organization, 80% of breaches are discovered by external parties, a number that clearly indicates the need for organizations to put more emphasis on threat detection and response operations.¹

Large, well-resourced organizations would typically build a Security Operations Center (SOC) to address these key areas and other threat management functions. However, if you lack the security expertise or budget to implement 24/7 monitoring and detection, or if you lack the tools to monitor and detect malicious activity across your network, endpoints, logs and cloud, consider leveraging an MDR services provider as an affordable and highly effective alternative.

MDR services are also ideal for organizations that are getting bogged down with false positives and suffering from “alert fatigue.” Acting as an organization’s SOC, MDR providers can use context and historical timelines to identify the threats that truly require the attention of security resources.

When a breach happens, it’s critical to have an incident response plan in place that can immediately guide you through each stage of response. During an incident is not the time for determining your policy on paying a ransom or identifying your key stakeholders. That’s what your incident response plan, discussed in Chapter 1, is for.

Your incident response plan is not a one-and-done exercise. It’s a living document that must be tested and updated regularly. Each person must understand their role and responsibilities in order for your organization to respond effectively. It’s also not a one-size-fits-all document. Your planned response to ransomware will be different than your response to a data breach, which will be different than your response to a lost or stolen device. Your incident response plan should include different playbooks to reflect different potential risks and scenarios.

It should also reflect different potential threat vectors. Malicious data breaches occur through a wide range of threat vectors, including compromised credentials, cloud misconfigurations, vulnerabilities in third-party software and phishing. In fact, according to IBM research, those vectors account for nearly 75% of all malicious data breaches.⁶

It often makes sense for an organization to seek outside expertise at this point in order to minimize the damage of an attack. Having access to SOC and incident response capabilities can dramatically shorten your mitigation and recovery time. Ideally, you’ve engaged an MDR provider that can move seamlessly into incident response when the time comes.

“A key value proposition of MDR is performing most of the incident response process,” says Toby Bussa et al. in Gartner’s Market Guide for Managed Detection and Response Services. “Timely and accurate incident response takes time and skill, which many organizations just don’t have, especially when multiple threats need to be addressed simultaneously.”⁷

“The goal of recovery is to move from the immediate aftermath of an incident to full restoration of normal systems and operations,” says the National Cybersecurity Alliance.⁸ Like all of the other components of the threat management strategy, it requires thoughtful planning to fully restore normal systems and operations. Recovery often begins immediately on the heels of – or overlaps with – incident response.

Companies that find themselves in this position are actually the lucky ones – the ones that are still in business after a security breach. Cyberattacks cost companies $200,000 on average, which is enough to put some out of business.⁹ Take this opportunity to put renewed emphasis on security across your organization and take the necessary steps to improve your cybersecurity framework.