Companies and organisations that exchange large amounts of data over networks must organise the protection of their information systems (IS) against external and internal threats. To do so, the security specialists of these entities need to know which IS strategy to develop to counter these risks. For example, using an IS dashboard is an effective IT security tool for applying this strategy.
The importance of IT security
Commercial data, customer records, health data… More and more sensitive information is exchanged and stored in digital form all over the world. The more valuable this data becomes, the more it tempts cybercriminals, and the more serious the consequences of its loss or damage for the organisations that are attacked.
This is how IT security has, over the past few years, become a major issue for companies. France’s national cybersecurity agency (ANSSI) noted a “high level of IT threats” in its press release on the 2022 cyber threat landscape. It recorded a 37% increase in the number of intrusions compared with 2021.
Yet many companies do not know how to go about responding correctly to this risk. The reasons given are often the same: a lack of in-house skills, a lack of information on the various risks, and the subject not being treated as a priority.
That is why Make IT Safe wanted to offer you a detailed article on this subject, to help you put in place an IS strategy suited to your company.
The need for regular monitoring of the IT security strategy
A company or organisation that wants to put an IS strategy in place must be able to steer that strategy and make it evolve over time, in order to know how to adapt to new threats and to correct any flaws or weaknesses in its IS.
In the recent past, some companies were still content with simple Excel spreadsheets to analyse the data from their IT security tools. This is no longer tenable today, and a company that wants to use a high-performing IS dashboard needs advanced reporting tools.
The different reporting tools
Reporting tools fall into 3 categories that are indispensable to any IT security strategy:
A) Monitoring tools
They actively assess the performance of your IT system in order to detect any flaws or slowdowns. They can also monitor displays, firewalls, servers and certain sensitive software.
Benefits:
- Speed of response when a problem is detected
- Alerts to administrators in the event of a failure or fault
- Detection and prevention of the causes of failure
- Prevention of the obsolescence of IT security tools
Monitoring tools watch over all your IT security devices 24/7. In the event of a failure or an attack, they immediately alert the IS managers and indicate the device concerned and the cause of the failure. They can also be used preventively, for example to flag the need to replace or update hardware. They are valuable allies for CISOs.
B) Dashboards
The CISO must take many indicators into account to analyse the overall IT security situation within their scope of responsibility. IS dashboards (see ANSSI’s TDBSSI guide) are indispensable summary and visualisation tools for keeping track of all this information.
Benefits:
- Make it easier to apply the IS policy
- Define the priorities for action on resources
- Provide the levels of achievement of the objectives set
- Compare KPIs between different organisations
- Help to improve the quality of service
The security manager consults their IS dashboard every day to check the status of their IT systems in real time. They also use it to plan and prioritise all the actions needed to maintain and improve security, in line with the strategy defined beforehand. Finally, they use the data from their IS dashboard to provide reporting to the other stakeholders concerned.
C) Activity reports
An IS activity report makes it possible to assess the current security level of your information system and to establish the actions to plan in order to improve IT security.
The activity report takes stock of the events that occurred on the IT system concerned over a given period, often a year. Many official or private organisations publish their own activity report. In the field of cybersecurity, the circulation of information and the sharing of knowledge are indeed essential.
An activity report also serves to show how risks are evolving, in order to put them into perspective when the company has to open up to new practices (for example, the introduction of remote working following the Covid-19 crisis).
Finally, it must remain compliant with the company’s general data protection rules according to the frameworks in force: GDPR, ISO 27001, NIST, LPM (the French Military Programming Act), Sapin 2…
Benefits:
- Assessment of the state of the cybersecurity threat
- Identification of the company’s vulnerabilities
- Support for the evolution of the IS strategy
- Preparation of action plans
- Presentation of the company’s overall IS results
As a tool for measuring risk, detecting vulnerabilities and monitoring the implementation of the company’s IS strategy all at once, the activity report is therefore one of the indispensable reporting tools.
How to choose the tools suited to your IS strategy?
A) Preliminary step: assess your reporting needs
Every company and every public service faces risks specific to its activity. We have seen it in the press: the theft of health data can, for example, lead to extortion (ransomware) against a hospital. The hacking of a subscriber customer file can leak millions of personal data records onto the Internet. You therefore need to choose your tools according to your own IS strategy, so that they meet your needs perfectly.
For example, when a company works with many subcontractors, it will need to use solutions capable of carrying out third-party analysis.
If the organisation to be protected has subsidiaries, it will need a tool capable of group-level steering in order to strengthen the cyber resilience of each entity.
Companies working in the supply chain will be able to put in place a Supplier Security Assurance Plan (SSA) with their clients.
To find out more about how to identify all your IT security needs, feel free to discover all the capabilities of our Make IT Safe solution, suited to the vast majority of companies.
B) Tool selection criteria
Depending on the tools you choose, you will have more or fewer KPIs related to your needs. You should therefore make your choice after defining the information you want to be able to analyse on your IS dashboard. You will then be able to select the tools that provide all the indicators you want.
The common mistake for a CISO is indeed to select a tool because it offers a very large number of indicators. The risk is ending up with a flood of data that is too large or difficult to get across to colleagues.
Relevance of the information
The information reported by your IS steering tool must therefore speak to the people you are addressing. For example, when the CISO has to present reporting to the executive committee (COMEX), the KPIs must be able to quantify the financial, legal and reputational impact on the company in the event of an incident.
In another scenario, the CISO this time has to convince the Information Systems Department of the urgency of training certain employees in new security rules. The data reported will then need to take into account the budget constraints and the security requirements of the company’s IS.
These two examples show it: the relevance of the information is decisive, so that the CISO, who is often forced to juggle conflicting interests within their management, has the arguments needed to convince their audience and get the necessary budgets approved.
Ease of use
Reporting tools must be as simple as possible to use in order to limit the cost of upskilling their users. In addition, intuitive use will allow safer and more efficient use, for the benefit of the company’s cybersecurity effectiveness. This is particularly important when the CISO has to simulate several attack scenarios or carry out penetration tests to check whether the IS is properly protected.
Cost
The cost of use, but also the amount of the initial investment (in terms of budget, hardware and human resources), also matters. Companies whose revenue is not yet well consolidated must be able to invest without too much difficulty in a solution for steering their security strategy, otherwise they risk overlooking some risks.
They thereby open the door to an attack that could prove fatal to them (80% of companies that suffer a loss of data after a cyberattack end up filing for bankruptcy in the months that follow).
Interoperability
An IT security steering solution must be able to work and communicate easily with the company’s other tools. To achieve this, the tool can for example store its data in file formats that are open to other software (for example: HTML, XML, CSV files…).
If the solution also has connectors or APIs allowing it to open up to extensions, the tool will then be able to exchange information with the other solutions used by the company’s IS. This will allow it, for example, to integrate security into the company’s projects (the concept of Security by Design).
How to report effectively on your IS strategy?
Despite the spectacular cases reported in the media, managers often find it hard to prioritise the information reported by their CISO or their DPO. It is therefore necessary to define a reporting frequency suited to the situation.
Make IT Safe recommends setting up regular follow-up meetings (at least once a month) during which a summary report is presented, with a list of objectives to be tracked from one meeting to the next. In addition, you should not hesitate to call a crisis meeting when a new cybersecurity risk is announced.
For each stakeholder to be involved in the company’s security strategy, they need key performance indicators that speak to them and that highlight the actions they have already taken. It is up to the CISO to communicate clearly and precisely on the results obtained and on the objectives still to be achieved.
Conclusion
Taking IT risk into account has become unavoidable for organisations and companies, and hackers know how to target those that have not yet properly put in place an IS strategy capable of stopping them.
In the face of this danger, it is vital to equip yourself with the right tools, capable of preventing risks, detecting flaws and summarising data on IS dashboards that are effective and relevant.
The CISO must be able to provide activity reports that everyone can understand, in order to keep every department of the company alert. Quality reporting is indeed their main asset for convincing and involving their management and colleagues in improving IT security.
Aware of the growing importance of these security issues in an ever more competitive world, Make IT Safe has developed an innovative and complete solution that addresses all cyber risks.
