Roger Grimes on Prioritizing Cybersecurity Recommendation
This can be a good level:
A part of the issue is that we’re consistently handed lists…checklist of required controls…checklist of issues we’re being requested to repair or enhance…lists of latest initiatives…lists of threats, and so forth, that aren’t ranked for dangers. For instance, we are sometimes given a cybersecurity guideline (e.g., PCI-DSS, HIPAA, SOX, NIST, and many others.) with lots of of suggestions. They’re all nice suggestions, which if adopted, will cut back danger in your surroundings.
What they don’t inform you is which of the beneficial issues can have essentially the most influence on greatest lowering danger in your surroundings. They don’t inform you that one, two or three of this stuff…among the many lots of which have been given to you, will cut back extra danger than all of the others.
[…]
The answer?
Right here is one massive one: Don’t use or depend on un-risk-ranked lists. Require any checklist of controls, threats, defenses, options to be risk-ranked based on how a lot precise danger they are going to cut back within the present surroundings if applied.
[…]
This particular CISA doc has a minimum of 21 important suggestions, a lot of which result in two or extra different extra particular suggestions. General, it has a number of dozen suggestions, every of which individually will possible take weeks to months to meet in any surroundings if not already completed. Any individual following this doc is…rightly…going to be anticipated to guage and implement all these suggestions. And doing so will completely cut back danger.
The catch is: There are two suggestions that WILL DO MORE THAN ALL THE REST ADDED TOGETHER TO REDUCE CYBERSECURITY RISK most effectively: patching and utilizing multifactor authentication (MFA). Patching is listed third. MFA is listed eighth. And there’s nothing to point their skill to considerably cut back cybersecurity danger as in comparison with the opposite suggestions. Two of this stuff should not like the opposite, however how is anybody studying the doc speculated to know that patching and utilizing MFA actually matter greater than all the remainder?
Posted on October 31, 2024 at 11:43 AM •
0 Feedback
