Best Innovation Group recently partnered with my friend, longtime industry expert and KnowBe4 Defense Evangelist Roger Grimes to discuss the steps credit unions can take immediately to improve their security posture. You can watch the full session here, but let me share a few of my favorite takeaways.
I found one of Roger’s slides particularly thought-provoking. He listed ten “keep you up at night” threats haunting security professionals. The problem is that leaders have only so much bandwidth and if you’re focusing on everything you’re focused on nothing. Roger then narrowed his list to the four items he considers the most critical today: state-sponsored attacks, ransomware, credential theft, and employee errors.
It’s worth noting that except for the latter, these issues are not the root causes of security problems but rather the end result. As is often the case with IT challenges, it boils down to blocking and tackling. And unfortunately, Roger points out that encryption is not a failsafe defense- since most attacks occur within the client-side, perpetrators have already secured the necessary access.
Paying attention to trends is among the most effective steps a security leader can take as a defender. Ransomware has become a headline topic in recent weeks, but those following the space have seen it coming for some time. Even aside from state-sponsored actors, it’s off base to equate these operations with basement hackers. In Roger’s experience many are highly professional businesses with resilient systems, expertly trained staff and even PR teams.
Thanks to recent outbreaks, another safeguard is becoming less reliable. Cybersecurity insurance is fundamentally changing, with new policies offering less coverage at higher rates and also attaching more qualifiers precluding payouts in many circumstances. Maintaining a system backup can still provide worthwhile defense, but only if it is stored offline and all dependencies are mapped out beforehand as part of a comprehensive recovery plan. In the event of an attack of the likes we’ve seen recently, the fix is not as simple as reverting to a saved past system version. Decisions must be made on which portions to restore first, and understanding all interactions are critical to that process.
Roger predicts that within a decade, IT security will essentially boil down to an ongoing battle between good bots and evil bots. Listen here for more tips on steps you can take to protect your systems today before that army of bots is prepared for duty.