DECEMBER 2024ENTERPRISE SECURITY| | 9Security Operations team likely does not manage your Secure Email Gateway solution, they should have input as front-line responders into the policy to understand what is being blocked and what functionality is turned on. This should apply to other tools in the organization's defense-in-depth strategy, such as internet proxy filtering, intrusion detection capabilities, and Microsoft Group Policy objects around auditing and log generation. It's also crucial for those that invest in a Managed Detection & Response (MDR) or Managed Security Service Provider (MSSP) to share as much information as they can with that vendor to provide as much context as possible. Their success will be your success; just feeding them data with no context will lead to incomplete or even poor outcomes during event triage.By investing time to ensure there is a strong relationship between the solution owners of the Secure Email Gateway and your Security Operations or Threat Intelligence teams, you can greatly reduce your commodity malspam and phishing volume at the front door via ensuring vendor best practices for the configuration of policies. This investment in time and effort will transition down into a drastic reduction in risk to your users and endpoints. A ransomware incident does not occur in a vacuum and typically starts from commodity info stealer malware delivered through email malspam. This initial access vector remains one of the top intrusion verticals in 2023. If you can stop this malware, you will stop It's crucial you get an idea of what they are being alerted and responding to and find the root causes, and improve resilience by shifting that risk further up the cyber kill chain before that to prevent events becoming incidents or reducing their frequency. This same approach in collaboration is crucial when it comes to patch management as well. Having strong relationships built on trust and respect is going to be so crucial for the time when the security organization makes recommendations for prioritized patching or when you need to execute an emergency incident response process for patching, such as Log4J.As a member of information-sharing groups such as RH-ISAC, I can't emphasize how strong the return of value is for being able to collaborate with our peers openly and transparently. We all face the same challenges and are usually targeted by the same or similar threat actors. Being able to attend working groups dedicated to sharing observable data or helping each other come up with solutions for challenges we are facing when it comes to securing endpoints or other focus areas. In conclusion, we must remember, as the adage goes, the attackers only need to be right once, while the defenders have to be right all the time. We cannot get things right without thorough collaboration between security teams and our IT peers. Building a strong security-driven culture throughout your IT environment, from the administrators through to the users, will lead to strong outcomes and greatly increase enterprise resilience. ESFOR ANY SIZED CYBER SECURITY ORGANIZATION, HAVING STRONG RELATIONSHIPS BETWEEN YOUR IT OPERATIONS, ENGINEERING, AND SECURITY TEAMS IS SO CRUCIAL
< Page 8 | Page 10 >