{"id":21190,"date":"2018-12-06T17:00:16","date_gmt":"2018-12-06T17:00:16","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/ciso-series-strengthen-your-organizational-immune-system-with-cybersecurity-hygiene\/"},"modified":"2018-12-06T17:00:16","modified_gmt":"2018-12-06T17:00:16","slug":"ciso-series-strengthen-your-organizational-immune-system-with-cybersecurity-hygiene","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ciso-series-strengthen-your-organizational-immune-system-with-cybersecurity-hygiene\/","title":{"rendered":"CISO series: Strengthen your organizational immune system with cybersecurity hygiene"},"content":{"rendered":"
<\/div>\n

One of the things I love about my job is the time I get to spend with security professionals, learning firsthand about the challenges of managing security strategy and implementation day to day. There are certain themes that come up over and over in these conversations. My colleague Ken Malcolmson and I discussed a few of them on the inaugural episode of the Microsoft CISO Spotlight Series: CISO Lessons Learned<\/a>. Specifically, we talked about the challenges CISOs face migrating to the cloud and protecting your organization\u2019s data. In this blog, I dig into one of the core concepts we talked about: practicing cybersecurity hygiene.<\/p>\n

Hygiene means conditions or practices conducive to maintaining health<\/a>. Cybersecurity hygiene is about maintaining cyberhealth by developing and implementing a set of tools, policies, and practices to increase your organization\u2019s resiliency in the face of attacks and exploits. Healthy habits like drinking lots of water, walking every day, and eating a rainbow of vegetables build up the immune system, so our bodies can fight off viruses with minimal downtime. Most of the time we don\u2019t even realize how powerful the protection of these behaviors are until that day deep in January when you look around your office and realize you are one of the only people who isn\u2019t sick. That\u2019s what cybersecurity hygiene does; it strengthens your organizational immune system. It\u2019s a simple concept until you start thinking about the last time you resolved to start practicing healthy habits but were skipping the salad by day three because big salads make your stomach bloat and you\u2019d rather have a candy bar anyway.<\/p>\n

Success starts with strategy<\/h2>\n

No matter where in the world I am, CSOs and CISOs tell me their days are filled with fire drills and crises that consume attention and resources but don\u2019t help advance a strategic agenda. A little like that candy bar\u2014drawing focus in the present but diverting energy from long-term goals. In the precious moments of downtime, when cyber executives can turn attention to long-term strategy and proactive security measures, it\u2019s not uncommon to have those goals diverted in a different way\u2014chasing the latest trend that the board is excited about or having to react to failure or a finding from a recent security assessment.<\/p>\n

Consistent change changes systems<\/h2>\n

Our bodies are systems\u2014when we eat more vegetables our microbiome changes, it becomes easier to digest those veggies and can actually begin craving them. But if you stock the pantry with candy instead of leafy greens, it\u2019s hard to make a consistent change. For cyberhealth, you need a strategy that works with the strengths of your organization and mitigates its weakness. It\u2019s a little like planning to be healthy. If you are social, it can help to enlist a friend in your exercise routine. If you work late, you can buy prepared, healthy food, so you aren\u2019t as tempted to grab that candy bar after a long day.<\/p>\n

To implement good security practices, take some time to understand your budget, your priorities, and your greatest vulnerabilities and allocate your money appropriately. Create strategic cybersecurity targets and goals for the next one, three, and five years and engage the C-Suite and board in the approvals. You will feel more empowered in conversations with the C-Suite when you have a good rationale and a solid plan and when cybersecurity hygiene becomes a systemic part of the organization, the healthy system will start to crave it.<\/p>\n

Practice good cybersecurity hygiene<\/h2>\n

Once you have a strategy, you are ready to institute some best practices. We recommend getting started with the following to all our clients, big and small:<\/p>\n