The Journey to Better Cybersecurity in 2020 and Beyond
The year 2020 will be remembered as the time when widespread internet-enabled remote working became a reality. IT administrators saw their responsibilities increase dramatically as their employers came to depend even more on their enterprise to provide organizational stability, versatility, and agility.
These new challenges made an already difficult job even more demanding. New applications and ways of working required new approaches to implementing and managing complex IT infrastructures. The more complex these systems, the greater the risks involved in protecting critical infrastructure and data from cybersecurity threats.
The journey to achieving better cybersecurity
There are many solutions today that promise to improve an organization’s cybersecurity. But choosing the right solution depends largely on how far along a company is on its cybersecurity journey. How large is the enterprise and how dispersed are its assets? How mature is its infrastructure and its existing IT security program? What business objectives need to be met today, and more importantly, tomorrow?
More than a specific cybersecurity product, IT managers need guidance so they can apply a full suite of solutions across their increasingly complicated and ever-growing domains. This guidance comes from real-world analysis like that found in the free CIS Community Defense Model (CDM). The CDM identifies real-world cybersecurity threat types and patterns and matches these to industry-recognized best practices.
These best practices are codified in community-driven, vendor agnostic guidance found in the CIS Controls and the CIS Benchmarks. These globally-recognized best practices for securing IT systems and data are developed by a global network of security experts and offered free for download from the CIS website. The CIS Controls in particular take into consideration the reality of the threat landscape. CIS recently defined basic cyber hygiene as Implementation Group 1 of the CIS Controls, which can help protect organizations from the most likely attack vectors.
Managing and measuring progress
Knowing the threats and how to counter them is just the beginning of any cybersecurity journey. As solutions are implemented, organizations need a way to keep track of their programs and ensure that the solutions they applied are working.
CIS CSAT is a management tool that makes the security guidance of the CIS Controls easier for IT security teams to implement, track, and document. A key feature of this tool is the ability for organizations to collaborate across teams with a built-in workflow.
The answers to the questions posed in CIS CSAT generates an overall score that shows how well an organization has implemented the CIS Controls. A hosted version of CIS CSAT has been available since January 2019, with the most recent v1.3.0 update occurring in June 2020. This version is and will remain free for non-commercial use by any organization. In August 2020 CIS CSAT Pro was introduced, an on-premises version offering some new benefits.
Assessing IT resources wherever they are
Remote workers rely on secure, portable equipment including laptops and smartphones to perform their jobs. IT administrators have had to implement updated access controls to keep criminals from taking advantage of this increase in a remote workforce. Useful guidance on what to do under these circumstances can be found in the free CIS Telework Guide and the COVID-19 Resource Guide.
IT managers need to be able to assess the cybersecurity status of all of their IT resources regardless of where the employees are working. Helpful guidance can be found in this blog post about remote configuration security. A tool such as CIS CAT Pro Assessor, available to CIS SecureSuite Members, can be used to easily assess remote endpoints.
Helping customers remain viable and safe
It’s not only IT managers, administrators, and security teams who have had to change how they work. IT consultants, vendors, and service providers have also experienced new challenges in how they serve their clients. Most of their customers are no longer located in centralized office locations, and there are also limitations on visits to clients’ sites. However, the cybersecurity needs of their clients have only grown.
Cybersecurity consultants need to be able to service their clients wherever they are, from wherever they may be working. Fortunately there are now many reliable ways for professional IT security experts to provide services remotely, using industry-recognized best practices and tooling, such as these available to services and consulting organizations, and security product vendors.
An easier and more direct route to improved cybersecurity
The journey to better cybersecurity has never been more challenging. Fortunately, there is more information, more tools, and more resources available today as well. This short video provides just a glimpse of what the Center for Internet Security (CIS) can offer:
No matter where an organization’s employees may be located, or wherever it may be on its cybersecurity journey, we can help. CIS is trusted by thousands of CIS SecureSuite Member organizations, and by security product vendors, consultants, and service providers who incorporate these resources into their offerings.
Learn more about CIS SecureSuite
