Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Cybersecurity Self-Esteem: 4 Things Confident Teams Are Doing
By increasing our cybersecurity self-esteem, we can truly make a difference in raising our collective cybersecurity resiliency.
4 Min Read
Security teams need to hear a public service announcement. "Believe in yourself. Have confidence. You can do it!"
It may sound corny, but it's true. I've spoken to more than 600 organizations -- from mature businesses to entry-level startups. What I’m noticing is that many of these cybersecurity teams -- from Singapore to Silicon Valley - do not have good self-esteem right now.
Believing
Progressive security teams are advancing largely because they “believe.” They believe they can improve their postures; believe they can achieve some form of resiliency; and look at their battlefield with an engineering mindset. Other security teams aren't faring so well. Too many practitioners give others too much credit and not enough to themselves.
I see and hear low self-esteem all the time:
"Oh, but our team isn't advanced."
"Yes, but we're not software engineers."
"Our budget isn't as big as theirs."
"We're already overwhelmed with AV alerts."
While I understand why these teams think they cannot change their own status-quo, they are wrong. They simply don't realize what they're capable of. They give up at being transformative or at moving to a higher maturity level -- often without much of a fight.
Wasting Time
A lack of cybersecurity self-esteem leads to wasted "security time." We've already said we don't have enough people, so why do we fail to optimize how our teams spend their time?
We should be looking at getting the greatest return-on-investment from security time. Does your team do any of these things:
Repeatedly respond to false alerts?
Manually conduct lookups to see when a domain was registered?
Fight with committees to get ports opened for your security tools?
Sit in meetings that really don't require them to be there?
I see all of these way too often. Security teams are often not able to use their time most effectively. And so we fail. The adversary goes undetected. Tools aren't configured properly. Valid alerts get lost in the noise, or the hunt to find that evasive intrusion never happens. Then the annual security reports come out reflecting detection and response times in months rather than minutes. This has to change.
Building Up Our Confidence
The silver lining here is that we can build up our confidence. There are success stories. There are teams with 100,000 computers and only two FTEs that are finding and eradicating evil, and doing it in more and more automated ways.
There are companies that send their employees with little more than a laptop into countries where cyber hygiene hasn't yet become a trend, and these teams are able to find threat signals. There are teams of one or two people at banks that are continuously improving their posture so much that the red-teams are frustrated.
None of these teams are perfect, but they are progressing and raising the bar for their adversaries. Here are four things I’ve seen confident teams do successfully to help build their cybersecurity self-esteem:
Extend an olive branch to IT: While you might not be enemies with IT, you probably don't have the best relationship. IT is the ultimate provider of security, so the more you can leverage IT to have gold images, setup proxies, use whitelisting of domains, URLs, and applications, and restrict user accounts, the easier your life will become.
Make security a team sport: Can you get employees excited? Can you leverage that excitement so that each user is more vigilant, more cautious when doing things, and more willing to give up some freedoms such as installing random software or visiting certain websites? This vigilance goes a long way in reducing the number of threats and noisy events that clog your analysis systems.
Pick a tool or technology and leverage the hell out of it: Teams have too many tools, too much information, and are overloaded with defensive "weapons" and information. Pick one type of log or technology and become experts in it. Use every feature. Leverage every alert or log and tune it to make sure the ones you don't need to see are no longer sent. Push it to its limits. Then move on to the next. You'll find that you really only need a handful of tools or logs for most of your security.
Empower your team: Make hunting a perk. Empower your team to go find stuff and reward them for their time spent “outside the box” of responding to alerts. Get the team to take pride in their security posture. Be sure to keep meetings and other non-essential items to a minimum so your team feels like the Special Forces they are. Unless a meeting or task is vital, keep them in the game while they're on the clock. Then let them disconnect and rejuvenate. This will pay dividends for your organization and will also help with retaining employees.
There's a huge "can't do" attitude that’s plaguing security teams. This attitude arises because security leaders and practitioners have hit too many walls, often made of human flesh. It's time to stand up and say: “No. This is our environment. We are going to protect it.”
We may never be perfect, but we can do better. By increasing our cybersecurity self-esteem, we can truly make a difference in raising our collective cybersecurity resiliency.
About the Author
You May Also Like
More Insights
