Gaining a clear understanding of how to focus your time and energy continues to become cumbersome. With the everchanging landscape of technology, staying competitive is already complex enough. Now add Cybersecurity to the mix and things get even more convoluted.
Recently, our sister company, AutomaTech, and Nozomi Networks hosted a webinar on how to navigate the complex Log4Shell vulnerability. During the webinar, the audience was asked a series of questions designed to better understand three main elements of an organization’s cyber strategy within IT/OT/ and IoT: organizational readiness, technology adoption, and technology expertise. This post is designed to help ignite the conversation around where you may be in your own cyber journey and how to further evolve.
Step 1: Create a baseline of what strategy is in place
Like all journeys, you need to know where to start and where you are heading. Take a moment here to define what you want the end result to be, do not focus on the details yet.
For example, “We want to know what we have and be able to protect from outside attacks. We would also like to know where to focus without having to redo everything”
· It’s imperative to know what the strategy is on a local level
· Must understand how local strategy fits into larger scope
Step 2: Make note of all inefficiencies in both strategy and process
Now that you have an idea of where you want to get to; how far away is it from where you are now? You may need a “map” to figure it out. The NIST framework is a very good starting point. The NIST ICS framework breaks things down into 5 actionable categories.
1. Identify
2. Protect
3. Detect
4. Respond
5. Recover
Back to the beginning Step 1 (Identify)
Where are gaps in the solution?
Look at each step and evaluate what you have in place and what is missing or needs improvement
Step 3: Create a mind map of all tools and systems related to your strategy
Having a mind map helps you understand where systems communicate and where they don’t
Building on your initial framework, you can start understanding where key processes and tools falls within the framework. Going through this exercise with your internal teams will start to shine light on gaps in processes and any overlap that exists. The outcome is a deeper understanding of your own eco-system.
Don’t get caught up on how to facilitate a mind map, what’s more critical is ensuring you have the right people in the room and are able to open the conversation around the framework that works best for you. Allocating the right amount of time can help break barriers of understanding and help begin putting the pieces of your eco-system together.
Create an inventory of software and work with vendors to understand the impact of log4shell
To better understand what applications are impacted by Log4Shell an inventory is critical to cross reference any affected applications and systems provided by the vendors. At this point, most if not all vendors have provided clear indication of the impact of the Log4Shell vulnerability. Outside, of just log4shell, the best practice is to gain visibility into what exists. There are several tools that automate visibility, but if they are adopted too early, the tools will only add to the complexity and will not give you a clear picture of the eco-system.
This is typically where gaps can be uncovered between teams and infrastructures. Some people have certain context, and if the right cross-functional team is developed, it could speed up the process and ensure everyone has a better handle on all things inventory. Then automation can be valuable. Having 24/7/365 inventory will help continue the evolution of internal processes and understanding of what steps need to be taken to remedy any gaps.
Step 4: Determine which systems overlap and where and fill gaps
Some systems will overlap but cannot be replaced because of how critical they are. It’s key to understand these systems and how to ensure you’re maximizing value from them.
Once a mind map is developed, a key framework is adopted, and inventory is constructed, you can begin looking into dependencies, inefficiencies, and gaps. This is where the real magic can happen. Typically, overlaps will exist and sometimes, tools that have become the status quo can be deemed redundant with no added value. The goal, once again, is to create the conversations and understanding of the architecture, communication paths, and features that each system fulfills. Don’t be shy to include one or many vendors in these calls to drive alignment your adopted framework.
Organizations typically believe one system will solve all their problems, but reality shows that no “one size fits all” exists and every set of requirements is different.
This is a key item to note. There is no “one size fits all” or “system that does everything.” If a vendor suggests this, their solution has several features that probably only go surface deep. In certain circumstances this may be sufficient, but the key is to understand your needs and your strategy. Vendors can help educate and guide, but most do not extend this, even while charging. If certain vendors are willing to go that extra mile and learn about your environment to help devise a strong scalable eco-system in a collaborative way, then the vendor is probably looking more like a partner to scale with.
Step 5: Setup consistent evaluation of evolving strategy
What happens next when a strategy has been adopted?
Once a well-defined strategy is adopted by the many teams involved, the work doesn’t stop there. You must consider that the cyber landscape is ever-changing and will require tweaks throughout. The
number one idea is to have a strong foundation where small incremental changes will not seem daunting. There must be a continuous cadence to evaluate the strategy as time goes on.
Step 6: Ensure training is available to key players
With new systems in place, you want to ensure that the right daily users are maximizing the value within your org.
If your org continues to depend on your vendors for any changes within their tools, then you become too dependent. The real sweet spot is when there is a strong understanding of the joint strategy and the needs of your facilities / networks, then working with vendors that will help guide and enable your team to solve problems, create strategies, and evolve processes. The key to this is to take advantage of any readily available trainings and clearly designate roles and ownership of different components within your cyber strategy. Internal experts will help bridge the gap along with the necessary services from your vendors.
We all continuously hear about the cyber journey and its large impacts on our organizations. People adopt technologies rapidly and hope to build strategies and processes around tools and technologies. In this ever-changing landscape you do not want to be Pidgeon-holed by a tool, but rather you want to ensure the partners you choose will continuously enable your strategy and help fill the gaps of the frameworks you adopt. It’s a long-term play where cultural changes will occur, and the goal will be to have the tools at your disposal for everyone in your organization to be well-equipped to contribute as their roles define.