The continuing skills shortage
A 2021 survey found that over 57% of organizations continue to feel the impacts of an ongoing cybersecurity skills shortage. The same survey found that 95% of respondents think the skills shortage hasn’t improved at all over the last few years. CISOs know that proper security risk management depends as much on the right people as having the latest tools and technologies. There are no easy answers for navigating this skills shortage over the coming years, but CISOs do have some options, such as:
Leverage automation: security automation can help close gaps in skills shortages by replacing tasks normally performed by human analysts with computers. Good candidates for automation include triaging alerts based on risk and severity, pushing out software updates, and provisioning user access to different accounts. Outsource security tasks: third-party managed security services provide organizations with a way to access the skills they lack more cost-effectively. Organizations can choose from fully outsourced security operations centers to project-based options such as penetration testing and compliance monitoring. Invest in security training: part of the security skills shortage stems from existing security professionals not maintaining or advancing their skillsets through structured training programs. Organizations willing to invest in better training and provide upskilling opportunities for other business professionals stand better at addressing the skills shortage.
Credential stuffing attacks
Threat actors continue to exploit poor password hygiene with alarming regularity. Quite apart from the security skills shortage, CISOs need to contend with the issue of a basic lack of security awareness that permeates many organizations. The blame for this lack of awareness starts with organizations not adopting a culture that prioritizes security. One particular type of attack that takes advantage of poor password hygiene is credential stuffing. When data breaches occur, threat actors steal and sell lists of stolen username and passwords combinations on the dark web. Opportunistic hackers know that people reuse the same passwords across different systems. In a credential stuffing attack, hackers use lists of compromised credentials and attempt to access accounts and services with those same credentials. According to Salt Security, some ways that CISOs can help their companies defend against credential stuffing include multifactor authentication (MFA), CAPTCHAs and behavioral analytics.
Hybrid workforces
The almost overnight change to remote working driven by the global pandemic exemplified the rapidly evolving dynamics of the information security landscape. CISOs quickly had to account for new potential risks from remote access technologies and poor visibility into end-user activity on remote endpoints. Many employees welcomed the flexibility provided by remote working. Cross-industry demand for remote work arrangements looks set to continue for the foreseeable future. Some employees will want to return to the office, but others will undoubtedly prefer to work from home. This new hybrid work landscape creates security challenges that CISOs need to address. Connecting to unsecured Wi-Fi networks, downloading malicious email attachments or losing devices with sensitive company data represent a small sample of the issues CISOs need to consider in the hybrid workforce of the future. Securing the post-pandemic hybrid workforce calls for a rethink in budget allocation towards zero-trust and endpoint visibility solutions. CISOs also need to consider insider threats emerging from lax security policy enforcement by remote workers.
Advanced Detection and Response
As hackers evolve their techniques, more advanced threats bypass perimeter-level security controls, such as firewalls or endpoint antivirus solutions. Once these initial controls have been breached, organizations have trouble detecting and responding to threats on their network. Hackers can move laterally through the network and eventually inflict severe damage with ransomware or data exfiltration. It’s prudent to consider more advanced detection and response solutions that detect threats lurking inside the network already. These solutions should facilitate faster response times to those threats by not inundating security teams with high volumes of low-level alerts. Ideally, CISOs should plan to adopt solutions that leverage advanced machine learning capabilities that can match these more advanced network threats.
Closing thoughts
Balancing business and security risk management is a tricky act that ultimately defines CISO’s success in their roles. CISOs need to wear many hats if they want to effectively deal with tomorrow’s cybersecurity threat landscape in a business-aware way. In practice, this means being aware of the main technical, process and people-related challenges at their organizations and finding ways to deal with those challenges effectively.
