Organizational controls for Cyber Risk

How do I ensure that my organization has controls to protect itself from cyber risk? In other words, what are the key controls that my company must implement to protect itself from cyber risk? There are excellent security frameworks available as public documents that can be used as cybersecurity baseline controls.

Here is my list of essential controls:

Patch management—it is essential to have a structured patch management process. It does not mean that all patches have to be applied, but the enterprise has to make a conscious decision on which to apply and which not to apply. Patch management should be done as a priority for critical applications. While many enterprises apply patches for their IT infrastructure on a priority basis, it is common knowledge that the same rigor is not applied to patch management for software applications.

Administrative privilege control—it is key to remove administrative privileges from all and grant them only to a select few as determined by job need. Some individuals see it as a status symbol to hold admin privileges. Local admin rights must be removed for a significant majority of users.

Dynamic analysis—conducting dynamic analysis, which uses behavior-based detection capabilities instead of the conventional approach of relying on the use of signatures, helps enterprises to detect malware that is yet to be identified. Such dynamic analysis can be undertaken at the enterprise’s main gateway, the end point or the cloud, depending on the specific, relevant scenario. Customized sandboxes will help perform structured dynamic analysis.

Host-based intrusion protection/detection system (IPS/IDS)—Host-based IPS/IDS’s detection strength is based on behavior instead of conventional signatures.

Segmenting—segmenting the network based on business criticality is yet another essential control. Active Directory and other authentication servers should be able to be administered only from a selected number of intermediary servers called “jump hosts.” Jump hosts must be well secured, and jump host access must be limited to a predefined list of users and network devices/equipment. Ideally, jump hosts will have no Internet access.

Multifactor authentication—though a number of users view it as painful, it is essential to implement multifactor authentication in the interest of the enterprise.

Internet access—Direct Internet access from all end points/desktops/laptops must be denied and must instead be processed through a proper proxy.

Passphrase policy—for service accounts and privileged accounts, it is essential to implement a passphrase policy instead of a password policy; this is yet another area of common resistance.

Web site access—Access to web sites must be via their domain names and not by IP addresses.

Removable storage media—Usage of removable storage media must be appropriately controlled—though any restrictions on these are viewed by users as a loss of rights. Any enterprise keen to protect its sensitive information from leakage must restrict access and grant it based on a business need.

User education—it is not necessarily for all business users, but about educating the developers to write secure code and infrastructure experts to manage it in a secure manner. While users from the business appreciate the risk to the business, it is these experts from the IT world who require more convincing.

External email exchange management—when emails are exchanged with entities external to the enterprise, it is essential to adopt and implement protocols such as transport layer security (TLS).

Strong asset management—In terms of having an inventory of authorized devices, equipment and software are essential. Asset management is another area that does not get accorded its due priority.

Web application testing—whether the web applications are developed in-house or by a third-party, it is essential to test them for vulnerabilities. They must also be tested via simulated attack scenarios.

The staging environment—Security testing such as a vulnerability assessment or a penetration test must be done in a replica of the production environment; otherwise, the gap between the environments becomes the weakest link in the chain.

Wireless networks management—Access must be granted on a need basis with adequate restrictions, and sundries must not be allowed to connect in an unrestricted manner. Ideally, network admission controls mechanisms must be in place.

This is a very indicative list and must not be deemed as exhaustive. Please choose a security framework relevant and apt to your enterprise and use it. These days, cyber risk insurers also provide guidance documents that they consider prerequisites for any enterprise to buy cyber risk insurance policies.

In my opinion, it is essential to identify relevant controls and implement them in the most appropriate manner rather than implementing a huge list of controls that are irrelevant and inappropriate. And, of course, the best controls rely on competent professionals to make them work effectively.