As technologies become increasingly innovative, the threat landscape continues to evolve and increase in its complexity. Organisations are under growing pressure to enhance cybersecurity strategies to best protect and defend against potential risks and threats. However, while cybersecurity is a key priority for many organisations, developing an effective security approach goes beyond simply investing in the latest defences.
Jon McGettigan, regional director, Australia, New Zealand, and the Pacific Islands, Fortinet, said “While it’s essential that business executives prioritise cybersecurity, the complexities of the threat landscape demand a systematic and strategic approach that identifies and prioritises assets and dedicated defences. This will help illuminate key areas for investment in cybersecurity measures.”
Rather than taking a ‘protect everything’ approach, which often leads to nothing being effectively protected, CISOs should implement a two-pronged approach to prioritising cybersecurity concerns, according to Fortinet:
1. Align cybersecurity strategy with business priorities
Understanding the disparity between business priorities and cybersecurity strategy is one of the first steps in developing a priority-based approach to cybersecurity. By first identifying core business priorities, CISOs and IT security teams can work with other executives to bridge the gap between what is important to business leaders and what is critically important to the organisation’s cybersecurity defence.
Jon McGettigan said, “By developing a deeper understanding of the gaps between organisational and cybersecurity priorities, executives can begin to align the two strategies to ensure key priorities are addressed first and resources are allocated accordingly. During this process, it’s essential for business leaders to reach a mutual agreement and an understanding of the roles and responsibilities of each team.”
2. Identify potential vulnerabilities
Executives must work with IT security teams and CISOs to identify external and internal vulnerabilities, as well as other potential risks affecting the changing threat landscape.
Jon McGettigan said, “CISOs and business executives need to be cognisant of all potential threats their organisation faces. This includes internal risk factors they can change and influence, and external risks they need to defend against. While it’s essential that executives align and prioritise business objectives and cybersecurity strategies, they also need to classify the level of risk each threat poses and determine how to best defend against them.”
3. Define roles and responsibilities
When everyone in the organisation understands their cybersecurity roles and responsibilities, collaboration can lead to seamless protection. For example, business leaders need to: communicate their needs and concerns; identify the business-critical assets, people, and processes that need to be protected; and set goals and budgets for cybersecurity initiatives. Cybersecurity leaders need to: identify vulnerabilities, threats, and countermeasures; measure, monitor and report on cybersecurity return on investment; and undertake day-to-day cybersecurity operations.
Jon McGettigan said, “When business and security leaders can work closely together, the results invariably improve. Neither group can work effectively without the input of the other, so it’s important to avoid silo-based approaches.”
