DECEMBER 2022ENTERPRISE SECURITY| | 19while maintaining a minimum level of `security hygiene' across the board, that being the security requirements your systems must meet and comply with, across all business units within the organization. Managing the balance between these two areas and the objectives of other business functions is where information security teams find their challenges. The effort required to not just to list every system­ if you don't know them all, then you cannot be sure you know your Crown Jewels ­but have senior management agree and endorse the list of those systems can't be underestimated. It also can't be a one-off activity;managing your systems and lists require regular reviews based on the pace of change in your business. Once you have identified the Crown Jewels of your business you need to define the level of security they require. It needs to be above the minimum level set for everything, but how far above? What additional controls need to be applied to these systems, such as micro-segmentation or more frequent User Access Revalidation ­ otherwise known as UAR ­ activities? Identity is central to this security;you need to know who can access your systems and whether they should. This can be controlled through a request and approval process, regular access revalidation and finally, removal on termination. There should be absolute minimums that apply to all your systems, and increased controls that apply to the Crown Jewels. Depending on your industry and business context, an annual binary revalidation may suffice. Simply put, should user Jamie Bloggs have access to the system or not? It's a binary ­ yes or no. The next level of activity might be half yearly, quarterly or even monthly revalidation of account existence and the level and type of access the user has. For example, if you're an organization processing millions of dollars each day, you will need tight control over who can approve those payments. In this instant, monthly reviews at the detailed permission level might be most suitable.Setting the right security culture is important for ongoing success. Security is everyone's responsibility but not everyone can, or should, be a security expert. You should ask yourself, what is the security role you want each employee to take? What relationship do you want the business and its people to have with your security team? How do you facilitate these roles and relationships with effective training and awareness? At Allianz Australia, for example, we set a phishing reporting requirement this year for all managers and executives across the organization. This was linked to individuals KPIs and not only encouraged the right behaviors for secure security practices but also facilitated the accountability required to achieve distributed responsibility for security within the business. As a result, we have seen improved uptake of training initiatives, improved results in phishing simulation exercises and increased security awareness across the business. For cyber security to be effective it needs to be viewed as a critical business enabling activity ­ something that is a key part of winning the next contract or maintaining the customer's trust in the firm and its products. When you lead with this objective and focus your conversations and culture to this objective, you'll be heading in the right direction to improve your organizations security posture. ESEFFECTIVE CYBER SECURITY IS ABOUT KNOWING WHAT IS IMPORTANT TO YOUR BUSINESS ­ THAT IS, IDENTIFYING THE `CROWN JEWELS' AND FOCUSING SECURITY RESOURCES, SUCH AS PEOPLE, TIME, MONEY AND ATTENTION, TOWARDS THEM
< Page 9 | Page 11 >