The Security Operations Center (SOC) is central to this defense strategy – a dedicated hub for monitoring, detecting, and responding to security incidents. But as businesses grapple with establishing their in-house SOCs or outsourcing to specialized Managed Security Service Providers (MSSPs), many considerations come into play. 

In this article, we discuss the complexities of these choices, shedding light on the benefits of managed security. 

Read More

The cyber security skills gap is real and growing; there simply aren’t enough cyber security employees to go around.

Cyber crime is rapidly escalating, and board rooms are taking notice. KPMG’s 2017 U.S. CEO Outlook survey shows cyber security risk to be among CEOs’ top concerns, yet only 40% of them feel that their organizations are fully prepared to handle a cyber attack. This isn’t surprising in light of the very serious – and worsening – cyber security skills gap. The cyber security unemployment rate was zero in 2016, and it’s expected to remain there until 2021. Coincidentally, that’s the same year by which Cybersecurity Ventures predicts there will be 3.5 million unfilled cyber security jobs.

Small and medium-sized firms are being hit the hardest by the cyber security skills gap, as the short supply of qualified talent is quickly snapped up by multinational firms that can afford to pay the high salaries and provide the “Cadillac” benefits and perks that this talent has the power to demand. The situation is expected to worsen in light of New York’s new cyber security law, which requires finance and insurance firms operating within the state to hire CISOs and “qualified cyber security personnel.”

Governments and private-sector organizations are wringing their hands over how to deal with the problem. The mayor of New York City has announced a plan to invest $30 million in in cybersecurity training, academic research, and development labs, with the goal of creating 10,000 new cyber security jobs over the next decade. IBM has launched what it’s calling a “new collar” jobs initiative to train both students and older workers in cyber security.

Outsourcing the Best Way to Immediately Bridge the Cyber Security Skills Gap

In light of the cyber security skills gap, the best option for most organizations is to outsource their cyber security functions to a reputable cyber security provider such as Lazarus Alliance. Our Cybervisors® service allows organizations of all sizes to immediately retain the services of the best and brightest subject matter experts in cyberspace law, cyber security, risk assessments and management, audit and compliance, governance and policies, and more.

In addition to getting the help you need right away, there are many other benefits to outsourcing your enterprise’s cyber security functions, including:

• Significant cost savings. It is almost always less expensive to outsource cyber security than to hire and maintain a security team full-time in-house. Even outsourcing just part of your cyber security functions, such as compliance, could result in significant savings.
• Allows you to focus on your business’ core competency. Most likely, you don’t hire in-house staff to handle your own legal matters or do your own taxes. You realize that law and accounting are not part of your core competency, so you outsource those functions to attorneys and accountants. (Along the same lines, you probably outsource your building security to a security firm!) Using this logic, why would your firm handle its own cyber security? Outsourcing this function to a professional frees up monetary and human resources that can be used to create, innovate, and drive your business.
• Allows you to access a level of expertise most companies don’t have internally. Cyber security is a highly specialized field, and the skill set it requires is quite different than those in other IT areas. It’s also highly dynamic, with new technologies and threat vectors emerging daily. Our Cybervisors® focus on only one thing: cyber security. They are highly experienced in this field, they are immersed in it, and they engage in continuous education to stay abreast of the cyber threat landscape.

Initiatives like the ones New York City and IBM have launched are positive steps in the direction of bridging the cyber security skills gap, but training new cyber security professionals takes time, and organizations need help right now. Your organization can’t wait 10 years, or even six months, to get the security help it needs, at a price it can actually afford. The cyber security skills gap is here for the long-haul, and outsourcing is the best way to handle the problem right now.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

Every organization needs an effective cyber security policy

Anyone who has taken the CISSP exam knows that cyber security policy is at the top of the policy/standard/procedure hierarchy. The logic is that cyber security policy must come first because it identifies the organization’s security issues and their scope; it answers the question, “Why do we need to do this?” Only after understanding the why can an organization develop quantifiable measurements and determine what is required (standards), then establish the proper steps to achieve the standards (procedure).

Cyber security policy protects information within an enterprise, defines rules regarding consistency and fairness, and ensures compliance. Yet despite the high importance of cyber security policy, many small and medium sized businesses (SMBs) lack effective security policies. Some don’t have them at all! This “ad hoc” approach to enterprise cyber security has become such a problem among defense subcontractors that the DoD is developing a new compliance framework to address it.

Regardless of size or industry, every organization must have documented IT security policies to protect their digital assets. Many compliance frameworks, including HIPAA, PCI DSS, and SOC attestations, require written policies, and policy documentation will also help your company defend itself defend itself against fines and civil litigation in the event of a data breach.

Types of IT security policies

The CISSP defines three primary types of cyber security policies.

• Regulatory policies ensure that an organization is adhering to industry-specific compliance mandates or laws, such as those governing public utilities, financial institutions, or other organizations operating in the public interest.
• Advisory policies specify which employee behaviors an organization considers acceptable and unacceptable. While advisory policies aren’t mandatory per se, employees who violate them face serious consequences, ranging from serious warnings to termination.
• Informative policies educate an organization’s employees or business partners without laying out any specific or implied requirements.

These three IT security policy categories can be broken down further into organizational, system-specific, and issue-specific policies. An organizational (or master) security policy is the blueprint for an enterprise cyber security program; it outlines the company’s strategic plan for implementing cyber security. System-specific policies dictate the approved software, hardware, and hardening methods for specific systems. Issue-specific policies address functional areas that require additional attention and detail, such as IT security policies governing email usage, change management, access control, data retention, and vulnerability management.

Developing & maintaining an effective cyber security policy

Depending on an organization’s size, industry, risk profile, and data environment, their IT security policy could range from a one-page guide to a book containing dozens of pages. Here are some general tips for developing an appropriate and effective cyber security policy.

• Understand your compliance requirements and align your policies with them. If you don’t know where to start, applicable compliance mandates are a good place.
• Understand your infrastructure. Work with your IT team to map the systems you have in place, their capabilities and vulnerabilities, and your current backup and security measures.
• Clearly identify security controls. This includes which specific security programs are to be implemented, timelines and procedures for updates and patches, and backup procedures.
• Clearly identify employees’ roles and responsibilities. An effective IT security policy must define accountability, such as who is responsible for maintaining and enforcing policy, who is responsible for training users, and who responds to security incidents and each person’s role during response.
• Outline acceptable use conditions. This includes acceptable use of the company internet connection, social media usage policy, remote access rules, and the proper procedure for reporting security incidents.

Cyber security policy is not “one and done.” The cyber threat environment is in continuous flux, and security policies must be reviewed and updated on a regular basis.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.