The Single Cybersecurity Question Every CISO Should Ask

In early December 2018, several major corporate breaches were made public. As the news was shared and discussed around my company, one of my colleagues jokingly asked, "I wonder if I can gift some of this free credit monitoring to my future grandchildren." It was a telling comment.

Today, every organization – regardless of industry, size, or level of sophistication – faces one common challenge: security. Breaches grab headlines, and their effects extend well beyond the initial disclosure and clean-up. A breach can do lasting reputational harm to a business, and with the enactment of regulations such as GDPR, can have significant financial consequences.

But as many organizations have learned, there is no silver bullet – no firewall that will stop threats. They are pervasive, they can just as easily come from the inside as they can from outside, and unlike your security team, who must cover every nook and cranny of the attack surface, a malicious actor only has to find one vulnerability to exploit.

The security challenge is compounded by the security talent gap, which has reached crisis levels. That is why executives in every industry must ask themselves: How do I scale the resources I have to meet the cybersecurity needs of my organization? The hidden answer: IT operations.

Uniting for a Common Purpose
In a world in which security and IT operations are often at odds, this may seem counterintuitive, but the truth is what SecOps calls "the attack surface" is what IT ops calls "the environment." And no one knows the enterprise environment – from the data center to the cloud to the branch and device edge – better than the team tasked with building and managing it.

Many of our most sophisticated customers already use IT operations to help build a more robust security posture. Drawing from conversations with these organizations, industry analysts, internal experts at ExtraHop, and my own experiences from decades working in business operations, here are some of the most important things CIOs and CISOs can do to create a co-operational framework for security and IT ops.

• Security cannot come at the expense of uptime: For any organization, ensuring the consistent availability and performance of business-critical systems is paramount. If a security measure compromises availability, the business itself is compromised. Security teams need to work with IT ops and line-of-business stakeholders to understand performance requirements and then build a security framework that accounts for an acceptable level of risk.

• It's OK to fail if you can recover: Efficient business operations always require some level of risk, and that means accepting that some failures are going to happen. For security teams, this means accepting that malicious actors will get in. The question becomes how quickly you can detect, investigate, and stop that activity.

IT operations, with its working knowledge of system behaviors and interactions, can play a vital role in helping to detect threats before they result in disaster. They just need the tools and understanding to know what to look for. Just as line-of-business stakeholders work cross-functionally to scale knowledge and improve outcomes, security and IT ops will better serve the business through collaboration.

• Responsibility for secure operations can and should be shared: If you provide IT ops with the right tools, it’s possible for SecOps to use IT ops for some important security activities. These should be lower on the risk scale, and they should be things that don’t require a high degree of specialized knowledge.

• Cooperation benefits compliance as well: While breaches grab headlines (and garner record-setting fines), compliance failures can also have significant business consequences. Regulations such as GDPR and HIPAA require organizations to meet strict standards for protecting data and privacy. While SecOps and IT ops play their own roles in ensuring clean and compliant practices, sharing both knowledge and resources is a smarter way of scaling to meet compliance demands.

Moving Forward
From the interactions between applications to how to create secure configurations, far too often we find that IT ops and SecOps fail to share important knowledge. As too many organizations have learned the hard way, this siloed, sometimes oppositional model can have serious consequences.

There is no perfect fix for cybersecurity, and nothing will ever be 100% secure. Threat actors are highly motivated to find new and innovative ways around every solution that tries to keep them out. But with a combination of strategy, structure, staffing, and systems, it’s possible to gain an advantage that will evolve and scale to keep disaster at bay. 

Finding talented security professionals is becoming increasingly difficult. But when you promote an environment of cooperation and communication, you can build a more scalable enterprise security solution for 2019 and beyond. At the end of the day, the best team wins.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.