-
United States
AMERICASASIA PACIFICEUROPE, MIDDLE EAST AND AFRICAEUROPE, MIDDLE EAST AND AFRICA
AMERICAS
ASIA PACIFIC
EUROPE, MIDDLE EAST AND AFRICA
EUROPE, MIDDLE EAST AND AFRICA
en_us
August 30, 2021
Ransomware has become a familiar front page news topic thanks to recent high-profile attacks against a major meat producer and an East Coast operator of a critical oil pipeline. Also, consider the attack on a provider of software tools to IT outsourcing shops that let hackers paralyze hundreds of businesses on all five continents.
No doubt the ransomware threat is serious, and now Washington is mobilizing to wipe out a scourge it formerly treated only as a criminal nuisance. But the outcome of this battle will rest less on how we respond to ransomware, per se, and more on how we approach cybersecurity broadly. Unfortunately, as the great comic strip character, Pogo, put it long ago, “We have met the enemy, and he is us.”
Promoting best practices to detect and respond to ransomware is key, but it’s also important that organizations focus on stopping poor security practices to prevent it. And for reasons I’ll soon explain, that’s where we’re still falling short — by a wide margin.
Until recently, ransomware wasn’t viewed as a national concern, largely because the attacks usually weren’t large enough. The Biden administration has a robust appreciation for the risks posed by ransomware and cybersecurity, more generally. But its eagerness to effect change may not be enough to stir the widespread inertia in the private sector.
Security Discipline Missing
A lot of companies, in particular small and medium-sized organizations, still don’t have a chief information security officer (CISO) or even teams dedicated to security. I’ve come across examples where the person sitting at the front desk is also charged with the responsibility to change the Wi-Fi password once a month. That may be an extreme, but it speaks to the truth on the ground where the situation is often quite bad.
Meanwhile, the sudden obsession about ransomware distracts us from recognizing that we’re talking about a style of attack, just one threat among others. Ransomware just so happens to be very visible and so it gets talked about a lot in the news nowadays. Still, let’s avoid assuming that it’s the only security worry.
We need to muster a broader response that focuses on adopting security as a discipline and build the foundation for a solid security program (Prevent, Detect, Respond). That’s going to drive a lot more change. Unfortunately, it’s also a lot harder and tedious to put into practice.
A lot of companies either haven’t adopted that discipline or have made do with shortcuts, folding security into some other function inside IT. That shortsighted approach not only fails to treat cybersecurity seriously, but it also mixes contradicting goals. The person responsible for the corporate network, whose goal is reliability, speed and availability, isn’t necessarily going to understand what a ransomware or phishing attack involves. How to prevent or mitigate a breach may not be evident, especially when preventative measures like patching may get in the way of their stated goals.
By this point, there can’t be any more debate over the argument that security should be treated as a separate discipline, one that that’s adequately funded and staffed like any other important job inside the organization. Any organization can find itself under attack tomorrow, and you can’t have five guys doing security for a company with thousands of people.
Fixing the Problem
That failure to treat cybersecurity as a discipline leaves companies vulnerable to making otherwise avoidable mistakes. I commonly see organizations using products and services from suppliers where security was given short shrift during the development process. The only way companies can mitigate that risk is by building the capability to thoroughly vet third parties to make sure that the security-worthiness of any products meets their standards.
And that calls for a more sophisticated approach, which goes back to how we treat suppliers and customers within the context of overall cybersecurity.
- Policy is always the foundation of any security program, so refresh yours to make sure it’s sufficiently robust to meet the gathering threats and evolve with new threats and technologies.
- Enhance, or, in some cases, start end user awareness programs from scratch. Focus on cybersecurity and train employees and executives to recognize the phishing ruses that attackers use to infect networks with ransomware and other malware. Ransomware attacks often are related to awareness —and lack thereof — because they always start with somebody clicking on a booby-trapped email link.
- Establish a vulnerability assessment program. Identify your devices to find and fix or mitigate any flaws before attackers can locate them.
- Shine the spotlight on third-party security. Elevate supplier security and make it a regular part of the assessment process. Otherwise, even the best security program is vulnerable to attack. This isn’t hyperbole. Once you grant network access to an outside firm, even for a short-term contract, everything’s on the line. If a consultant accesses your network using an insecure device, you’re in trouble.
Notice that I’m not calling for specific technical fixes like firewall configurations to solve specific, tactical problems. Let’s get over that flavor of the month approach. It’s time to get strategic and start building solid pillars that will support a lasting security foundation.
Otherwise, we’re going to be reading about more of these mega-security nightmares, whether caused by ransomware or something else that comes down the pike.
Chris Jacquet is Vice President and Chief Information Security Officer at Hitachi Vantara.
Check out more great stories on Insights.
Related Articles
Why Leading with Code Creates Innovative, Software-Driven Companies
Why leading with software is increasingly critical for companies to compete in both the digital and physical worlds.
Read the Article
Everything as a Service Can Actually Help Unlock New Business Outcomes
Tom Christensen addresses IT business leaders' common concerns regarding transitioning to an everything-as-a-service (XaaS) model.
Read the Article
4 Key Frameworks for Optimizing Cloud Strategy and Deployment
Is your cloud strategy on target? Learn about four frameworks from Samta Bansal to optimize your cloud strategy and deployment.
Read the ArticleSubscribe to Insights
*Subscribe and automatically receive new stories as they post. By subscribing to Insights by Hitachi Vantara and providing your e-mail, you agree and consent to Hitachi Vantara’s Privacy Policy and Website Terms of Use.Data Controller: Hitachi Vantara Corporation. Purpose: manage Hitachi Vantara’s Blog. Lawfulness of processing: Your express consent. Retention Period: Personal data will only be stored for as long as necessary for the purposes it was collected. Recipients of personal data: Personal data will not be communicated to third parties, unless there is a legal obligation to do so, or the communication is necessary to fulfill the purpose. Rights of the data subjects: You are able to exercise your “Data Subject Rights” through our online DSAR form or privacy@hitachivantara.com
Read More +First Name
Last Name
Business Email Address
Title
Company
Address
City
Phone
Postal Code
Additional Information(optional)
Thank you. We will contact you shortly.
Note: Since you opted to receive updates about solutions and news from us, you will receive an email shortly where you need to confirm your data via clicking on the link. Only after positive confirmation you are registered with us.
If you are already subscribed with us you will not receive any email from us where you need to confirm your data.
Explore more about us:
To Talk to a Representative,
Call 1.678.403.3035
You’re in the Right Place!
Hitachi Data Systems, Pentaho and Hitachi Insight Group have merged into one company: Hitachi Vantara.
The result? More data-driven solutions and innovation from the partner you can trust.
You’re in the Right Place!
REAN Cloud is now a part of Hitachi Vantara.
The result? Robust data-driven solutions and innovation, with industry-leading expertise in cloud migration and modernization.
You’re in the Right Place!
Waterline Data is now Lumada Data Catalog, provided by Hitachi Vantara. Lumada Data Catalog, available stand-alone, is now part of the Lumada Data Services portfolio.