Lawrence Lazarko

I would advocate for implementing three tiers of metrics tailored to different audiences: a high-level view for the board of directors, a more detailed view for the executive team, and a streamlined version at the department level. It's crucial to provide context for these metrics, ideally comparing them not only month-over-month but also against a peer group of similarly sized companies in the same industry. This comparison enhances the relevance and competitiveness of the metrics. To further enhance our strategy, leveraging advanced analytics and real-time monitoring technologies can provide ongoing insights and allow for swift adjustments, keeping our security measures both effective and adaptable to changing conditions

Some successful practices I've applied in my organizations include regular cyber awareness posts, where staff are encouraged to engage by liking or commenting for a chance to win a low-dollar-value gift card. Additionally, we've implemented monthly security workshops with specific teams (ex. spear phishing with finance) and monthly simulations of phishing attacks to test awareness and readiness. Leadership involvement is also key; having our executives actively participate in response planning and tabletops communicates the critical role of security. This approach not only keeps security top of mind but also fosters a proactive culture where everyone feels empowered to contribute to our resilience. Some of our best ideas came from staff.

Before conducting the assessment, it is crucial to establish a shared understanding of the organization's risk tolerance. Agreement on when, where, and for how long it is acceptable to operate outside the agreed levels of tolerance is essential. This common understanding will provide critical insights, guiding the proposed in-depth review of day-to-day operations to identify specific areas that could benefit from more or less stringent security measures.

In addition to internal measures, consider the crucial role of external partners in your cybersecurity strategy. Leveraging external cyber product and service partners can provide essential expertise and coverage at a significantly lower cost compared to insourcing these services. It's important to recognize that external partners, particularly those directly integrated into your systems as part of the extended enterprise, play a vital role in your overall cybersecurity posture. While these partnerships are necessary for conducting business, they also introduce potential threats that must be carefully managed and mitigated.

Utilizing the NIST-CSF framework, it's crucial to focus on the five key control areas: identify, protect, detect, respond, and recover. Each technical control aligns with one or more control areas, forming a layered defense model. Ensuring adequate coverage across all control areas is paramount. If a threat isn't adequately protected against, prompt detection and response measures can be implemented to address it before it escalates into a significant issue. An issue that has occurred and has been resolved can identify new controls needed, etc. By adhering to the principles of the NIST-CSF framework, organizations can establish a robust cybersecurity posture that effectively safeguards against evolving threats and vulnerabilities.

Utilize a comprehensive framework such as the NIST Cyber Security Framework to assess potential vulnerabilities across people, processes, technology, partners, and data. This structured approach breaks down the assessment into manageable phases and provides standards for organizational compliance. Additionally, frameworks continually evolve to adapt to new industry requirements or changes in the cybersecurity landscape, such as advancements in AI technology. By adopting a structured framework, organizations can systematically identify inadequate cybersecurity measures and prioritize necessary improvements to enhance overall security posture.