How resilient is your organization to cyber attacks?

Published on 23/09/2021 in Inspire

How resilient is your organization to cyber attacks?

No matter which cloud service, hard- or software a company uses, there is always a security risk involved. That’s why it’s vital to maintain an overview. “If you can’t see it, you can’t protect it”, says Stephen Corbiaux at Davinsi Labs.

In the context of cybersecurity, the term 'security posture' often crops up. This refers to the extent to which a company arms itself against risks. What is important here?

Stephen Corbiaux, Solution Lead Vulnerability Management at Proximus Accelerator Davinsi Labs: “Security posture mainly refers to resilience. How resilient is an organization to cybersecurity threats? To improve the security posture, you have to focus on extra resilience. You do this by working on three pillars: people, technology and processes. Do your employees recognize a phishing message? Is the security of your systems infrastructure up to date? Are there response procedures in case of an incident? First you have to map out how you score in all those areas. Once you know where you stand, you can focus on improvement.”

How can an organization tackle this in practical terms?

“A lot depends on the context, of course. Which data and systems do you want to protect? This is always preceded by a cost-benefit analysis: the costs of protection against the value of what you want to protect. It is important to get a global picture of the existing situation first, so that you can set the right priorities. A system with business-critical data that runs a moderate risk will then take precedence over a system that runs a high risk but which contains little of value.”

Do you have questions about your organization’s security? Talk to one of our experts.

Contact our expert Opens a new window

You cannot be active on all fronts at the same time. With cybersecurity, you have to focus on the actions that have the greatest impact with the least effort.

Stephen Corbiaux, Solution Lead Vulnerability Management at Davinsi Labs

author

The difficulty, of course, is that risks and priorities are always shifting.

“That’s true. You can’t get rid of the vulnerability of your network just once. The risks change over time. Technology and the business context are also changing. As a business grows, exposure to risk increases. You have to include all these elements in the exercise. At the same time, you must understand that you can’t be active on all fronts at the same time. It’s about focusing on the actions that have the greatest impact with the least effort.”

Visibility

Companies have to build a ‘modern network’, as it is called. What exactly does that term mean?

“The network used to be simple: servers and data were located on-premise, in our own datacenter. But that also came with risks, because as a company you had to manage everything yourself. In the meantime, the classic perimeter has disappeared. A modern network today is usually a hybrid environment: partly on-premise, partly in the cloud. Often, new organizations no longer have their own infrastructure and work entirely in the cloud.”

The risks change over time, including the technology and the business context. You have to include all these elements in your cybersecurity.

Stephen Corbiaux, Solution Lead Vulnerability Management at Davinsi Labs

This presents the IT department with a new challenge. How does it maintain an overview?

“In a hybrid or cloud environment, this is indeed less obvious. You can generate new instances in the cloud with one click. It is impossible to inventory and manage such activities in the traditional way. However, the IT department must also provide the necessary support here. If you can’t see it, you can’t protect it. That is why visibility is essential, because it also provides insight into the possible dangers.”

Clear communication

Shadow IT is the term that refers to those IT activities that happen under the radar of the IT department – and whose security that department cannot guarantee. What do you see as the biggest risk there?

“Anyone with an e-mail address and a credit card can purchase a service in the cloud. The danger lies mainly in the data that ends up on those systems. But as a company you can't possibly hermetically seal everything. There is no magic solution to avoiding shadow IT. Above all, you need to communicate clearly about it: pointing out the dangers, which then raises awareness.

At the same time, the IT department also needs to think about why people use shadow IT. Why does someone use an online file host? Perhaps because the solution the company provides doesn’t meet its needs.”

Why does the use of cloud solutions pose a potential security risk?

“Because the provider of the cloud service manages the platform for you, but not the cybersecurity. Today you can easily apply out-of-the box security to cloud services. With a solution for Intrusion Detection & Response, you can, for example, see who has logged in to your cloud service from which location – and respond if necessary. Of course, it remains a challenge to focus time and expertise on doing something with the alerts that your security environment generates. So, companies often outsource that part, employing an IT partner to strengthen their security posture via a managed service.”

Davinsi LabsNew window is a Proximus Accelerator and helps companies achieve Digital Service Excellence through specialised Security Intelligence and Service Intelligence solutions. In today's digital world, customers expect their data to be managed with the utmost security and they want a fast, flawless customer experience. As a Managed Services Provider, Davinsi Labs offers a portfolio of solutions to achieve Digital Service Excellence for the most business-critical applications and services.

Stephen Corbiaux studied software engineering at Erasmushogeschool in Brussels and is Solution Lead Vulnerability Management at Davinsi Labs.

One

One magazine is the Proximus B2B magazine for CIOs and IT professionals in large and medium-sized organisations.

Other articles of One