TECHNOLOGY
RATIONALISING YOUR CYBER ESTATE Relying on cyber insurance? ISO 27001 certified? You need to read this to avoid accidentally breaching your contract. By Scott Nursten, CEO, ITHQ You are ISO 27001 compliant. You have documented proof. But if your insurers asked you whether the critical controls you have in place were compliant and matched your processes, what would you say? We conduct assessments for businesses all the time that reveal, despite their ISO 27001 status, they are not actually compliant ‘on the ground.’ These same businesses often have a huge cybersecurity tech stack in place, made up of multiple expensive tools doing the same or similar jobs. This is like throwing three trap nets over your business and lining up the holes. You will have three tools protecting you from the same 70% of threats, crucially all missing the same 30%. At worst, these tools can impact each other negatively, giving you less protection for three times the cost. In the event of a serious, expensive breach, non-compliance and poor cyber resilience management can then also nullify your cyber insurance policy. Here’s how you avoid that nightmare scenario.
58
www.platinummediagroup.co.uk
WHEN LAYERS OF SECURITY WORK, AND WHEN THEY DON’T
It’s all about having the right tools in the right place. The mistake many businesses make is layering tool upon tool, believing more is better. Let’s take email filtering. It’s a hot topic. I know clients using Exchange Online Protection - the Office 365 email filtering, plus something like Mimecast, plus the mail filtering on their connected device. While this represents more layers of security, the layers are all doing the same job. You’re also facing
potential admin issues and disparate security profiles to deal with. Multiple tools can offer great security if they all do something different. It makes sense to have dedicated tools for antiphishing, anti-spam and outbound email monitoring to check for insider threats. This protects both inbound and outbound data, prevents the spread of viruses both ways and helps stop your staff from inadvertently sharing / leaking critical or sensitive data: covering several critical controls rather than one.
