There’s a big problem with the way that many businesses approach cybersecurity policy and protections. Are you making this key mistake?
Today’s post covers what many businesses get wrong about digital security — and how you can avoid making the same mistake.
Doors and Windows Have Limitations
There was once a church that kept discovering strange things missing from storage areas—especially the freezers where they kept food to serve to people in need. They wondered if it was mice, squirrels, maybe raccoons, but they couldn’t figure it out. The problem went on for months.
Eventually they discovered the real culprit when maintenance found a human-sized makeshift bed up in the rafters. A guy on the run had been hiding out, helping himself to items from the cafeteria.
Creepy, right? A stranger secretly living in a building where families and young children attend every week.
This church locked its doors every night. But locks alone didn’t stop the intruder.
Think for a second about your physical building. You have locks on the doors (and windows, if they open), and you should. These are no-brainer security measures that every home and office should have.
But they don’t do any good if there’s already an intruder who’s set up camp in the basement.
The Cybersecurity Mistake
So, what does this have to do with cybersecurity?
Simple: many businesses are laser-focused on protection— on keeping the bad guys out.
That’s like installing better and better door locks, security cameras, motion detectors, you name it. All good things to do, but they don’t help at all if someone breaks in through a different entrance—or if they’re already inside.
Cybersecurity solutions that focus primarily on access or prevention are important, just like those door locks are. And these solutions contain good things we’re always recommending to our clients, like multi-factor authentication.
But they aren’t a holistic solution. They work to stop the bad guys from gaining access, but these tools usually can’t detect if the bad guys are already here — and they can’t really do anything to get the bad guys out.
This Mistake Affects Large and Small Businesses Alike
We tend to think of cybersecurity as something only the big dogs need to worry about. Sure, those guys might need robust cybersecurity detection and response, but smaller businesses are probably fine with prevention via off-the-shelf security software, right?
Wrong.
This mistake is equally important no matter the size of your business. The tools you’ll use to fill this gap will look different if you have 10 employees than if you have 10,000, but the problem matters either way.
The Missing Links
The two missing links here are detection and response.
Security detection systems constantly scan your network and systems, looking for signs that an attacker is at work. In larger businesses this may be called security information and event management, or SIEM.
The third leg is response: when a problem is identified (detection), what will your business do to resolve that problem and patch that vulnerability? You’ll need a process and a system for dealing with detected threats. In larger businesses, this looks like a security operations center (SOC), a dedicated unit that builds processes and executes responses to threats.
What You Can Do
So, what can your business do about this? You probably can’t staff an SOC full of highly trained information security experts, and an enterprise SIEM solution might be out of reach.
Your best bet is to work with a managed IT provider like Blue Ridge Tech. We’ve implemented robust security systems and processes for numerous clients — ones that handle prevention, detection, and response.
Ready to patch your security holes? Reach out to our team today!