Episode 17: Cybersecurity Awareness Month, It’s All About the Big Picture

In this edition of Cybersecurity Where You Are, CIS Chief Information Security Officer (CISO), Sean Atkinson welcomes Philippe Langlois of the Verizon Business Group and co-author of the Verizon Data Breach Investigations Report (DBIR). In celebration of Cybersecurity Awareness Month, the duo discuss the DBIR and version 2.0 of the CIS Critical Security Controls (CIS Controls) Community Defense Model (CDM). Both reports pull data from a community of experts and many different resources to provide a more holistic picture of cybersecurity.

Discussed in this podcast:

Cybersecurity Awareness Month
Psychology of cybersecurity
Evolution of common cyber threats
“Big picture” resources

Cybersecurity Awareness: More than Just One Month

Cybersecurity Awareness Month (CSAM) was created to help educate everyone from enterprise to individual. Now more than ever, the mainstream public is aware of the danger of cyber threats. In the past, most may have thought that data breaches only affected large corporations. Newsworthy events such as the Colonial Pipeline attack and the more recent Facebook breach brings threats a lot closer to home. CSAM highlights the more relevant cyber threats of today and offers preventative resources to leverage throughout the year.

Cyber-Psychology

Cybersecurity is not managed by one group or component of an enterprise. Instead, there are three components to consider:

Technical
Business
Human

All three components have a different point of view regarding cybersecurity and an effective plan needs to consider – and speak to – all three.

While the technical and business components can make decisions based on risk management and security frameworks to guide them, the human component relies on their own awareness and decision-making. Unfortunately, people can make cognitive decisions based on their best judgement every day that can cause vulnerabilities. Langlois uses the analogy of flossing one’s teeth, “You may know you are supposed to floss every day, and while it is not very exciting, it is necessary for your health. An individual knows what they should do, but there is a step between being aware and actually making a change to behavior.”

Successful cybersecurity is not just about knowing how to prevent a threat like a phishing email, one should remain cognitively aware to look for the threatening email every time.

More of the Same, But Different

Cybersecurity is both complex and ever-changing and there is an inherent need to adapt more quickly. There have been threats to operating systems, emails, and desktop workspaces since they were created. Today, there is more reliance on technology and more users; that means more opportunities for vulnerabilities. While phishing has always been a threat, today’s “lures” are more creative. Emails may include topical references such as IRS stimulus checks, confirming personal data for social media accounts, or news on COVID-19. So while we all may know classic threat sources, we always have to protect against new, innovative strategies.

“Big Picture” Cybersecurity Resources

A lot of companies have difficulty seeing a full 360-degree view of cybersecurity. While there are numerous sources, there is no standardization around the information being gathered as no vendor can offer full visibility. Companies will tend to pick one they trust and ignore the rest for the sake of expediency. To solve this, two major publications have curated pertinent information and made the information easily digestible.

Verizon Data Breach Investigations Report (DBIR)

The DBIR is considered a must-read for both public and private organizations. This annual report, now in its 13th year, examines the major trends in cybersecurity and how they affect an organization’s security posture.

The CIS Community Defense Model (CDM)

The CIS Community Defense Model (CDM) v2.0 can be used to design, prioritize, implement, and improve an enterprise’s cybersecurity program. The CIS Controls and MITRE ATT&CK framework, combined with industry threat data to back the analysis, are the backbone of the CDM.

Organizations can utilize these resources to gain a better understanding of current threats and make better decisions for their company when creating a cyber defense plan.

Resources

Promo Terms

Subscribe to our podcast