2024 KuppingerCole Leadership Compass recognizes LoginRadius as Overall Leader.
Introduction
When it comes to cybersecurity, you deserve a straight answer. But the truth is, there is no one-size-fits-all solution. Every organization has unique needs, which means each one has to be protected in its own way.
That’s why we asked Alok Patidar, Director of InfoSec at LoginRadius, what some of the most common questions he gets from different stakeholders in the industry—and how you can protect yourself against those risks.
Q1. What’s the biggest myth that you would like to debunk on cybersecurity?
A. In cybersecurity, we often discuss attackers as faceless foes. I believe this is something we all do to keep ourselves feeling safe.
By thinking of them as something other than human, we delude ourselves into believing that their attacks are perfect and unsoundable. In truth, they are people who have been trained or have learned the tools to be successful on the internet and in our networks.
If we start to view them as humans with human goals, we can unravel how to break down their intentions, detect when they make mistakes, and build better controls to prevent their subsequent attempts.
Q2. What should be an organization’s biggest action to reinforce its cybersecurity posture?
A. As an organization comes to understand its cybersecurity maturity, it’ll become clear that there are certain things that, if done well, will contribute significantly to the organization’s security posture.
I believe those projects fall into three categories: configuration management, software patch management, and identity and access management. These represent some of the most common attack vectors used by hackers, and all three can be addressed inexpensively with a bit of planning and effort.
And the best way to do this is by adopting a framework like the NIST Cybersecurity Framework or Critical Security Controls. External audits often cover frameworks, allowing companies to understand better their security levels, gaps, and areas needing improvement.
Q3. What security layers should be incorporated to secure our systems, employees' details, and customer information?
A. As an employee or board member, it's your responsibility to know that the organization you're serving has the proper data protection measures. Every organization’s goal is to protect its customers, employees, and business information; boards don't need to decide how to implement each of these layers.
You need to know what layers of protection are in place and how well they work. Make sure your team knows exactly where you stand, then agree on getting all the right people involved in developing new policies and procedures so that every staff member knows exactly what to do when something happens.
Q4. What are the touchpoints that are on cybercriminals’ radar?
A. Most organizations fail to protect their customer information and employee details because they aren’t sure where the loophole lies. This means they have no clue what the next target for cybercriminals to exploit customer/employee data would be.
Asking your infosec team about the touchpoints that are more vulnerable to hackers is the best way to ensure employees remain safe by following the guidelines issued by their infosec team to protect that particular touchpoint.
On the other hand, educating customers regarding safe access to resources and non-disclosure of credentials could help reinforce customer identity security.
Q5. What protocol should one follow if a cyber attacker targets them?
A. When it comes to damage mitigation, one of the most critical cyber security questions is: how comprehensive is our plan, and how quickly can it be implemented? Another question might be: how open are we to updating our plan and adapting it for new situations?
Asking this essential cyber security question will help you learn how prepared your company is for a cyber attack and whether or not there is an opportunity for improvement so that if an attack occurs, you're ready to mitigate damage quickly and effectively.
Q6. Should one comply with the global data and privacy regulations?
A. Data privacy and cyber security have been critical concerns for American companies, but we’ve recently seen international regulations take a similarly prominent role in corporate policy.
The EU’s General Data Protection Regulation (GDPR) and California’s CCPA are perhaps the most noteworthy example of substantive global regulation affecting how businesses collect and store customer data.
Take a look at how GDPR and CCPA affect your business and ensure your organization complies with these regulations.
Q7. Should systems be really up to date to shield against the latest threat vectors?
A. Often, IT leaders aren’t aware of the fact that the biggest culprit in hampering overall organization security is their old-school systems.
Hackers can quickly attack and access most computer systems and networking devices since they lack a stringent defense mechanism. Hence, it’s crucial for businesses to timely update their critical networking and storage systems, including servers, routers, and switches.
Once all the devices are updated, the next step is to timely update their firmware to ensure they’re least susceptible to any cyberattack.
Q8. How do you know if you’re breached?
A. Most of the time, a breach isn’t detected for months and even years. And this could be the reason why organizations face a lot of financial and reputational losses.
Since businesses and employees aren’t aware of a data breach, cybercriminals exploit business information for months and even sell customer and business information on the dark web.
And it’s been observed that employees that aren’t aware or haven’t gone through cybersecurity training aren’t potent to analyze phishing scams, unauthorized access requests, and frequent authentication.
Hence, businesses must train their employees to analyze aspects that may indicate a breach or a sneak into their network.
Q9. What’s the response plan for employees in case of a breach?
A. Though every organization has its response plan to handle a data breach, its employees must know what they need to do at their end to mitigate the loss.
Often, the infosec heads are trained to handle data breaches and other aspects that may impact business security and privacy. However, slight negligence from the employees could be fatal for their organization.
Hence, it’s essential to train employees in a way that they can analyze any attempt of phishing, unauthorized access, or data theft and take the necessary steps to minimize the loss.
Also, it has been seen that most people don’t report a breach to their IT department due to poor cybersecurity training.
In Conclusion
With the changing cybersecurity landscape and increasing threat vectors, businesses must ensure robust security for their employees and customers.
Moreover, the employees and board members should be aware of all the cybersecurity best practices incorporated into their business to safeguard sensitive information.
Hence, the aforementioned questions can help clear their doubts regarding cybersecurity hygiene in their organizations and spread awareness regarding new cybersecurity challenges and ways to deal with them.
