6 Starters to Mitigate Risk of Cyber Attacks

Mitigating the risk of future cyber attacks hinges on an honest assessment of people skills, infrastructure adoption, and process evolution. Security literacy is built with training and engagement. Exposures are blocked by technology modernization. Business resilience is attained with DevSecOps.

A complete security assessment also measures the impact and damage of previous intrusions. Assessments identify entry points and document exposures. In healthcare, you can’t treat an illness without an accurate diagnosis. Similarly, you can’t mitigate risk without consensus on vulnerabilities.

Sadly, the majority of intrusions go undetected until after the damage has been done. Calculating the value of lost assets is fairly objective. Assessing the harm to organizational sustainability, customer confidence, and workforce morale is a lot more difficult.

• Can you assess the value of your at-risk assets and intellectual property?
• Will you be able to mobilize your workforce to mitigate a disruptive attack?
• What will be the impact to competitive advantage and customer trust if data is compromised?
• Are you protected against the financial impact of ransomware?
• Does everyone in your organization know they are responsible for cybersecurity?

At stake is a catastrophic loss of capital and brand equity. Security tools and processes will not stop adversaries alone. Competitive advantage is achieved by building customer trust. Ransomware is an existential threat. Everyone is responsible for vigilance and practicing security policies and procedures.

Assessing risks at all levels is important to understanding the types of mitigation required and the investment needed to make a real impact.

Actions to start right now to nourish a healthy security assessment and mitigate risks of cyber-attacks:

Some Dev and DevOps teams see security as a primary focus. Start shifting more Security responsibility left to Dev and right to DevOps as a core function and away from dedicated security job roles.

Champions promote security literacy, quantify risks, and model good practices. Security champions are not native security professionals. Rather, they are rewarded for integrating security principles into their primary job roles. A program ensures a steady supply of new and motivated champions.

Leverage the MITRE Attack Framework to learn about adversary group behaviors as they often repeat known attacks. Be forward-thinking.

More Software is crafted than coded. Integrate security acceptance testing into the crafting process. Leverage security routines from Open-Source libraries and GitHub repositories. Use Machine Learning (ML) as an assessment tool.

Harden your collaboration tools and usage policies. These are not temporary shifts.

You can’t improve what isn’t measured.

• Cross-organizational literacy in assessing vulnerabilities and mitigating risks.
• DevSecOps fundamentals to integrate security responsibilities into every job role.
• Security policies and procedures for hybrid infrastructure environments.
• Hands-on experience identifying security threats by industry and job role at a Cyber Range or practice lab.

• An Executives Guide to Security: Understanding Security Threats
• Aspire Journey: Security Analyst to Security Architect
• Secure Agile Programming: Agile Techniques
• Cloud Security Fundamentals: Cloud Application Security
• Penetration Testing Fundamentals
• Aspire Journey: Security Threat Intelligence