Cyber resilience: could you withstand a cyber attack?

Cyber resilience is often broken down into 3 core focuses – protect, detect and respond. As we’ve discussed, this includes a cultural shift towards security and compliance, as well as supporting processes. But your organisation can still lean on security tools to help, particularly with the first two – protect and detect.

The security tools I believe are critical investments for businesses of all sizes to effectively minimise their risk of cyber attack and improve cyber resilience are:

1. Endpoint protection

   With such a large number of attacks targeting workforces, using an endpoint protection (EPP) tool is critical to help you proactively block attacks and contain a breach if it should happen. EPP solutions have evolved a lot from basic anti-virus software tools and can now also include features for content control, USB blocking, device isolation and much more.

2. Network security

   From firewalls to intrusion detection and prevention systems, network security should already be within your existing security investment. These tools are designed to protect your organisation’s network and can provide high-fidelity data – the type that can be indicators of attack that many other log sources can’t give you. If configured correctly, these tools can be the first to trigger an alert to malicious activity.

3. Security Information and Event Management (SIEM)

   SIEM is a software solution that aggregates and correlates your security log data from different sources to trigger actionable alerts. Using a SIEM platform can help your organisation monitor its environment for suspicious activity and understand what action needs to be taken to remediate any issues.

4. Backup and disaster recovery

   These solutions ensure that data can be recovered in the event of a cyber attack and that your organisation can quickly return to normal operations. Most businesses do not have a defined incident response plan, which can make data loss and cyber attacks harder to recover from.

5. Identify and access management

   By controlling who has access to resources and information within your business you can ensure that only authorised personnel can access sensitive data. This can drastically reduce the severity of a cyber incident, as you can limit what data a potential attacker is able to access and exfiltrate.

6. Security awareness training

   Designed to educate employees about cyber threats and how to protect not only themselves but the wider organisation. When done well, this type of training is engaging and makes a real difference to your frontline security. When done poorly, it’s checking a box and providing a false sense of security. Security needs to be properly embedded in your workforce culture, otherwise you are taking unnecessary risks.