Data Breaches taught companies hard lessons in 2019. Even back then, Forrester’s VP and group director of security and risk research, Stephanie Balaouras warned that all companies need a chief information security officer.
In a February 24, 2020 MIT Technology Review Business Lab episode, Balaouras makes the case that the world of cyberthreats is becoming more intricate and perilous. Cybersecurity isn’t just stopping the threats you see, but also the ones you can’t see. “Even companies that have a Chief Information Security Officer (CISO) should take a hard look at how high in the organization they report,” Balaouras says. “Do they have the right budget? Do they have enough staff? Have you given them the right span of control?”
Thanks to technology we are able to carry our office with us, reach out and talk to anyone at anytime, and all at incredible speed. The mobile devices that make our lives so much easier, also increase the attack surface for cyber criminals. Few corporate functions have had to pivot so quickly or dramatically as cybersecurity operations. CISOs have had to take steps to minimize network threats targeting the legions of work-from-home employees.
According to a McKinsey article by Venky Anant, Jeffrey Caso, and Andreas Schwarz, “The response to the crisis continues to press department budgets and limit resources for other, less essential functions.”
Many companies are freezing their hiring because of the pandemic. Unfortunately, now is a risky, uncertain time to add full-time equivalent (FTE) employees. But companies, most of which don’t have the expertise in-house, need to hire a professional to lead their cybersecurity initiatives. What’s the solution?
VIRTUAL IS THE KEY WORD FOR 2020 & BEYOND
Virtual Cybersecurity Professionals (VSCP). VSCPs are the latest trend in cybersecurity hiring, bringing additional cybersecurity talent at a fraction of the cost, without requiring office-space, benefits, or training. VSCP don’t require on-boarding, and they can hit the ground running.
BUILD SECURITY ON A SOUND FOUNDATION
They are accustomed to handling a wide range of responsibilities geared towards protecting online data from being compromised. Sure, they safeguard organization’s files, networks, install firewalls, and monitor activity, but they should also create security plans that involve all employees of the company. As mentioned in one of our brief articles on phishing attacks, the best technology in the world isn’t going to protect a company’s data if the employees are not educated on the best practices of handling emails. Having mature fundamental processes in place are vital.
VSCP are not traditional employees that require significant investment. Nor are they consultants who are foreign and not part of your team. They are somewhere in between. As such, they tend to have greater access to C level executives. VSCP can be procured by days – you can hire a VSCP for Monday and Tuesday each week, for example – or for a certain number of hours each week. VSCPs typically work remotely, but schedule time on-site at least quarterly, or more often, as your budget and needs require.
In a Forbes article, Jon Younger explains that when a company “lacks the means to hire full time staff,” they can pull together essential skills and keep the business moving forward by combining full-time and freelance professionals together as a flexible, blended workforce. And increasingly, talent marketplaces are able to organize entire engineering or development teams on a “bolt-on” or plug and play basis.
There are downsides to VSCPs. Like all cybersecurity talent, the professionals are in high demand. There is an overall shortage in cybersecurity professionals. A recent Gartner report showed a 65% increase in demand for cybersecurity professionals and an estimated 3.5 million vacancy on the cybersecurity job market. Although they are easier to find than top-quality employees, it still can be difficult to find a quality VSCP. When you find a good VSCP, it’s important to retain them before their schedules become full. And like an employee, personality and team chemistry are important. Although they are remote, it is important that your security consultant fit your organization’s culture and gets along well with the team.
VSCPs are not an entirely new concept. Companies have been hiring Chief Information Security Officers (CISO) for years. Quality CISOs are difficult to find and expensive. A Virtual CISO (vCISO) is an outsourced security practitioner or provider who offers their time and insight to an organization on an ongoing basis, usually part-time. Working remotely, they are usually engaged to design an organization’s security strategy, and some may handle the implementation as well. vCISOs are less expensive than staff Chief Information Security Officers and with a quick time-to-value.
IN CONCLUSION
The pandemic seems to be expanding this need to a wider range of security tasks. Staff are separated, budgets are tight, but viruses don’t respect deadlines. Projects still need to be completed despite today’s difficult environment. As another Forbes article points out, “Times are challenging, and it’s time to get creative. Organizations must find a way to respond to modern cyber-threats without stretching their financial resources. The vast majority of security budgets are spent on managed services, and that includes consultancy. Because internal security teams need external help, there is a move away from on-premises products towards services.
A virtual chief information security officer (vCISO) could deliver the most bang for your buck.
Here’s why:
Vast Experience and Proven Leadership
No Training Needed
Reduced Overhead
Flexibility
Faster On-boarding
The VSCP concept was reserved mostly for vCISOs, but times have changed and the concept is ready to be deployed for various types of roles.
This might take the shape of a Cybersecurity Compliance Director who ensures the company is aligned with NIST 800-53, FedRAMP, or HITRUST, or prepared for the 2020 CMMC audits. It might be a Privacy Officer who ensures the company is abiding by GDPR, CCPA, or new the privacy laws of Texas or Nevada, ensuring that the company can keep doing business in those states.
Taking a proactive stance on your company’s cybersecurity could mean setting up an incident response program, a SOC or a SIEM, or a disaster plan. Or maybe hire a penetration tester, AI/ML expert, or cryptographer.
The possibilities are numerous, but even if you could hire all the people you could want, you wouldn’t be able to keep up with the vast scale of the cybersecurity threat problem. Phishing scams are on the rise. Smaller companies are being targeted just as much as larger companies because they are known to lack the resources; so, they’re easier to hack. Cybercriminals are sophisticated and they stay informed. They constantly adapt messages to more effectively scam victims. The FTC estimates $100 million dollars in coronavirus stimulus checks have already been lost to fraudulent cyber crimes. The constant threat of cyberattacks presents a huge problem for all industries and guarding against it effectively requires constant attention. That is why IronOrbit has its own division that handles nothing but security and regulatory compliance.
During these difficult times, companies need to ensure they have SOC processes in place, utilize virtual cybersecurity professionals, and incorporate automated security measures. Probably in that order. Whatever you do, as they say at the end of MIT’s Business Lab podcast, get outside help. You don’t want to go it alone. With IronOrbit, you don’t have to. Learn more about how we can protect your company. Check out our Security and Compliance section and then give us a call at (888) 753-5060.