In part one of this blog post, John Pescatore, director at the nonprofit cybersecurity training provider SANS Institute, delved into the legal challenges companies face as they strive to secure consumer information. Here, Pescatore discusses how companies can use various security standards available to create their unique set of security policies.
Considering the thicket of data security principles and factors modern companies have to consider, is there one governing body that can guide organizations as they navigate through it?
Unfortunately, there is no global governing agency or set of standards everyone has agreed upon, Pescatore said. While there are large and exhaustive security frameworks that companies can consult such as the NIST Cybersecurity Framework and the ISO 27001, what companies frequently need help with is discerning which practices are the most important and which they should do first, he added.
Companies can start with looking at the various structures and standards to help them prioritize the security practices that can help reduce the potential for attacks. Some examples of prioritization guidelines are the critical security controls offered by the Center for Internet Security/SANS, guidelines from the information insurance division of the NSA and the security standards outlined by the payment card industry.
There are a couple of ways companies can filter through these security standards, according to Pescatore:
- Pescatore advised companies to join the ISACs, or information sharing and analysis centers that are found within each vertical industry. Members of each ISAC collect, analyze and share actionable threat information with each other. The finance, industrial controls and automotive industries, for instance, have very active ISACs, and the healthcare and retail verticals have new ISACs sprouting up. “[Joining ISACs] are not expensive; they’re good ways to see what the best practices or common practices of your peers are,” Pescatore said.
- In the U.S. in particular, many cities have FBI-sponsored sharing organizations called InfraGard groups that are free for private-sector companies to join. InfraGard groups function similarly with ISACs in that participants, including academic institutions and local and state law enforcement agencies, share threat intelligence with each other.
Ditch the myths or fall behind
The bottom line, Pescatore said, is that every company is ultimately going to have different security and privacy policies and procedures based on how their business works. Establishing the right policies is reliant not just on basic principles such as stronger authentication and doing away with reusable passwords, however. It is also overcoming the myth that users will never accept these new security practices, he said.
For example, when companies are trying to instill stronger authentication procedures, it is detrimental to think “we can’t make the users do anything but reusable passwords, the vice president of sales will never stand for it,” Pescatore said.
This causes businesses to fall behind and fail to implement security measures that employees already practice as consumers. “Meanwhile, at home, [the VP of sales] is using his iPad with his fingerprint, using his thumbprint on his phone, to be more secure,” he said.