Leading CISOs have offered best practices for security leaders on how to manage cyber risks effectively during 2023 – 2024
Use Appropriate Frameworks – Cybersecurity frameworks are the best place to start in cyber risk management. Urge CISOs to look at factors like the size of the company, their current risk management program and their sector when deciding which frameworks to use. For example, ISO27001 is often useful for organizations who are at the mid-point of their risk management journey.
Understand Regulatory and Contractual Obligations – learn which cybersecurity regulations and contractual requirements their organization must adhere to. It’s surprising but not all organizations are adhering to what’s mandatory. CISOs should engage with the company’s legal officer if they are receiving pushback on taking measures to be compliant with a particular obligation. Understanding these obligations in full also helps security leaders develop the best ways to implement them, finding the middle ground between the letter of the law and impact on the business.
Create a Sustainable Vulnerability Management Program – A critical vulnerability does not necessarily pose a high risk to your organization. Therefore, security teams should develop an internal definition of what is a critical vulnerability to their organization, analyzing factors like exploitability rates and what systems are affected. This enables CISOs to develop a realistic vulnerability management program that prioritizes the most dangerous threats to their organizations.
Focus on the Basics – The reality is the vast majority of attacks are not sophisticated, such as social engineering and cracking passwords. Therefore, they urged CISOs to avoid the noise and focus on the basics of cybersecurity, such as implementing MFA, patching and access management policies.
Consolidate Security Toolkits – Many organizations have purchased an excessive amount of security tools, citing one case in which a company had 19 separate tools. This makes it impossible for security teams to manage. Instead, CISOs should prioritize consolidating and concentrating their toolkit.
