If you’re reading this article, you’re well along on your journey to understanding cybersecurity and privacy programs. Still, it’s a complicated and ever-changing business, and we all need as much information and help as we can get. But if you are like most businesspeople, there are a million vendors coming at you all the time–all with their hands open but few concrete answers. It’s difficult to know who to trust and where to turn for objective advice.
Before you begin developing (or fixing!) your cybersecurity program, make sure you know the fundamentals. This material, adapted from my first book, is stripped down to the essentials. You can refer to it again and again to refresh your understanding and review key principles.
In the alphabet soup of acronyms that are part of the daily life of every business, one acronym stands out: BIA, or a Business Impact Analysis. But what is BIA in the context of cybersecurity?
Zero Trust is a cybersecurity model in which an organization’s security posture starts by not trusting anything outside a well-defined and approved environment. If any resource (device, human, etc.) attempts to access the organization’s infrastructure it is automatically rejected.
XDR, MDR, and EDR are related but different types of third-party cybersecurity solutions.
The acronyms XDR, MDR, and EDR stand for Extended Detection and Response, Managed Detection and Response, and Endpoint Detection and Response.
SOAR, which stands for Security Orchestration, Automation, and Response, automates repetitive and time-consuming tasks, improves threat detection, and streamlines incident response. It utilizes low-code programming engines and integrated threat intelligence feeds, and it can create automated playbooks to respond against specific events (triggers), and leverage artificial intelligence in analyzing security incidents.
GRC (Governance, Risk, and Compliance) is a methodology to assure compliance and manage risk across the organization.
You can learn more about GRC and its three components here.
ESG, which stands for Environmental, Social, and Governance, is a way of aligning a company’s business practices with these new expectations.
You can learn more about ESG here.
Asset discovery and valuation is the cornerstone of all successful cybersecurity and privacy programs. Absent this, you don’t know what you’re protecting and—even worse—at what cost.
To effectively run a cybersecurity and privacy program, you’ll need to build core cybersecurity and privacy policies that govern these functions. These policies are critical in that they impact a wide swath of functions—from prevention to resilience and from identification to recovery.
Unlike many organizational policies that “come down from the mountain,” cybersecurity and privacy policies are derived following a substantial amount of discovery and assessment work.