A Single Partner for Everything You Need Optiv works with more than 450 world-class security technology partners. By putting you at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can.
We Are Optiv Greatness is every team working toward a common goal. Winning in spite of cyber threats and overcoming challenges in spite of them. It’s building for a future that only you can create or simply coming home in time for dinner. However you define greatness, Optiv is in your corner. We manage cyber risk so you can secure your full potential.
Beyond the Buzz: Building Cyber Resilience Breadcrumb Home Insights Blog Beyond the Buzz: Building Cyber Resilience July 25, 2022 Resilience is everywhere these days, in analyst reports, marketing materials, and board tables. While resilience is easy to talk about as one of the latest industry buzz words, implementing true cyber resilience is a complex but worthwhile endeavor that could save your organization millions should a cyberattack occur. It’s estimated that cybercriminals can penetrate 93 percent of company networks. There’s a ransomware attack every 11 seconds. Former Federal Bureau of Investigation (FBI) director Robert S. Mueller III, who during his tenure created the FBI Cyber Division, is known for saying “I am convinced that there are only two types of companies: those that have been hacked and those that will be. And even they are converging into one category: companies that have been hacked and will be hacked again.” Beyond traditional business continuity and business recovery plans, cyber resilience is a shift in mind-set, culture, and approach where you assume that operations will be interrupted at some point. This shift in mind-set from reacting to threats as they occur to assuming that a breach is only a matter of time helps you look at cyber-risk management in a new, vested light. When I speak with boards about cyber resilience, I talk about implementing resilient measures and practices across people, processes, and technology. By and large, I find that many organizations tend to focus on the technology investments they’ve made to shore up defenses, and far less on people and processes, leaving ample vulnerabilities that could prove hazardous down the line. If you find this to be the case within companies you oversee, below are a few tips boards should consider discussing with management to ramp up the “people” and “process” parts of the cyber-resilience equation. People Resilience Innocent mistakes and simple negligence make up 60 percent of insider incidents, costing the average organization $4.6 million each year, according to the 2020 Cost of Insider Threats Global Report. Cybersecurity is more about people behind keyboards than it is about technology. Threat actors, especially nation-state actors, prey upon innocent and well-intentioned employees. During my time at the FBI, I worked cases where threat actors used an employee’s social media accounts to groom them from an unwitting accomplice into a knowing coconspirator. People are the first line of defense, but still the weakest link. To boost people resilience, boards should ensure management takes the following actions: Implement a cyber culture. Make cybersecurity training mandatory for all employees from the C-suite and boardroom to the mailroom on an annual basis. Aligning training with Cybersecurity Awareness Month in October is a timely reminder. Build relationships and clarify roles. Identify the most critical systems, applications, and data you need to keep operations going. From there, identify roles and responsibilities. While this may sound obvious, when I served as chief information officer (CIO) for the FBI, I found documenting this helped me ensure that the right people were in the right roles, and that I had the right relationships and buy-in across the organization, which was crucial to keeping our systems secure. Stay current on cybersecurity trends. Threat actors are rapidly innovating and sharing information in real time, so we must constantly be shoring up our defenses and resilience so we can weather any storm. It’s also important to include updates from your CIO or chief information security officer in board agendas to keep dialogue open about cyber readiness, new threats, and potential vulnerabilities. Process Resilience As mentioned above, identifying mission-critical assets and mapping the process to protect them enables rapid recovery to a secure state when an attack inevitably happens. If you’re early in your cybersecurity journey, consider working with a partner who can deliver an incident readiness assessment that: simulates adversary tactics, techniques, and procedures in your environment, evaluates your strategies already in place, and can help identity gaps and suggest next steps. Boards should discuss the following areas of focus with management: Critical data protection. Identify assets and systems that are essential to continued business operations and that must be protected in the event of a cyberattack. Map interdependencies within your environment so your teams understand how to pivot and recover when crucial operations are interrupted. For more cyber-advanced organizations, consider implementing a vaulted, data-isolated backup solution that further prevents data corruption and loss. Cyber resilience framework. Create a framework that integrates backup solutions and enhanced security controls with the right governance and procedures to secure your business-critical systems. For more cyber-advanced organizations, establish workflows that can securely move business-critical data into an isolated environment. Recovery playbook. Create and maintain accurate recovery steps in a playbook to ensure resilience processes are identified, documented, and tested. For more cyber-advanced organizations, develop response plans that accelerate recovery for each stream, and consider doing live recovery exercises as well as cyber recovery tabletops to continuously test and improve response procedures. Cyber resilience is really about people, including culture and relationships, and process. Because people are still the weakest link in the cyberattack chain, creating an environment with your employees where they feel informed, included, and empowered to learn and reduce cyber risk is crucial. Using a process to understand your mission-critical assets is imperative, and developing the right relationships with sales, marketing, legal, communications, executives, and other stakeholders will make the road to recovery faster and less painful. Building resilience into the enterprise is no small task—but once it is implemented, it significantly reduces organizational risk and helps ensure that your business can keep doing what it does best. This article originally appeared on the NACD BoardTalk blog. Reprinted with permission. https://blog.nacdonline.org/posts/building-cyber-resilience By: James Turgal Vice President of Cyber Risk, Strategy and Board Relations | Optiv James Turgal is the former executive assistant director for the FBI Information and Technology Branch (CIO). He now serves as Optiv Security’s vice president of cyber risk, strategy and board relations. James has personally helped many companies respond to and recover from ransomware attacks and is an expert in cybercrime, cyber insurance, cybersecurity, ransomware and more. James draws on his two decades of experience investigating and solving cybercrimes for the FBI. He was instrumental in the creation of the FBI’s Terrorist Watch and No-Fly Lists. Share: Optiv Security: Secure greatness.® Optiv is the cyber advisory and solutions leader, delivering strategic and technical expertise to nearly 6,000 companies across every major industry. We partner with organizations to advise, deploy and operate complete cybersecurity programs from strategy and managed security services to risk, integration and technology solutions. With clients at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can. At Optiv, we manage cyber risk so you can secure your full potential. For more information, visit www.optiv.com.
Optiv Security: Secure greatness.® Optiv is the cyber advisory and solutions leader, delivering strategic and technical expertise to nearly 6,000 companies across every major industry. We partner with organizations to advise, deploy and operate complete cybersecurity programs from strategy and managed security services to risk, integration and technology solutions. With clients at the center of our unmatched ecosystem of people, products, partners and programs, we accelerate business progress like no other company can. At Optiv, we manage cyber risk so you can secure your full potential. For more information, visit www.optiv.com.
Would you like to speak to an advisor? Let's Talk Cybersecurity Provide your contact information and we will follow-up shortly. Let's Browse Cybersecurity Just looking? Explore how Optiv serves its ~6,000 clients. Show me AI Security Solutions Show me the Optiv brochure Take me to Optiv's Events page Browse all Services