People, processes, and technology, or PPT, are the three pillars of any cybersecurity strategy. As businesses seek to improve their security maturity, they need to find ways to improve upon their PPT as well.
It’s important to remember that people, regardless of whether cybersecurity is in their job description, all have a significant role to play in defending against threat actors.
Threat actors routinely leverage social engineering—from simple phishing attacks to worker impersonation—to trick employees and infiltrate businesses. On the other hand, human-powered threat hunting, Managed Detection and Response (MDR), and good cyber hygiene can help turn people into one of your biggest strengths in protecting your business.
In this blog, we break down the role of people in cybersecurity, covering the respective responsibilities, KPIs (key performance indicators), as well as training and education requirements.
Businesses need to make it clear to each employee that cybersecurity is everyone’s responsibility. While there are certain people or departments that have greater accountability to defending the business, such as the CISO (Chief Information Security Officer), security engineers, and SOC (Security Operations Center) analysts, it’s imperative to set clear expectations for each employee.
Below, we provide our perspective on how these responsibilities play out across organizational levels:
For businesses with a dedicated security team or individual, they must work across these groups and take a leading role in raising the collective cybersecurity awareness of the business while implementing the effective security controls based on the risk tolerance defined and set by the board and executive team.
When it comes to working with executives, the security team needs a seat at the table to help communicate the risks for their industry while providing clear recommendations in business language instead of technical jargon. For example, positioning how eliminating VPNs and expensive hardware firewalls with Secure Access Service Edge (SASE) can reduce capital expenditure while improving employee productivity and increasing security both in and out of the office.
At the same time, the security team needs to have a deep understanding of and appreciation for the business’ objectives, tailoring their recommendations to enable the business to safely operate while not creating unnecessary friction. By doing so, security teams gain buy-in from executives that help them better establish a culture of security across every organizational layer.
For management, it’s about empowering them with the tools and resources they need to execute their responsibilities effectively. Activities here can range from conducting a cyber risk assessment on a new tool the sales team is considering to telling them about a novel way threat actors are leveraging a critical business tool and what they should tell their team. Security teams should also collaborate with management to create personalized plans for front-line employees based on their performance in cybersecurity awareness training.
With front-line employees, security teams need to foster a culture where employees feel comfortable sharing suspicious activity before it becomes an issue. At the same time, it’s about building an effective curriculum to educate staff on good cyber hygiene such as strong passwords and locking laptops when not at your desk.
Within the security team, it’s about continuous monitoring and improvement based on data to improve the security posture in alignment with the determined risk tolerance. This includes implementing new technologies to fill gaps or increase efficiency and effectiveness. It’s also about how they leverage data—inclusive of the evolving threat landscape—to do their jobs better. For example, when a new threat is identified, the people need to hunt for the threat in their environments while creating additional detections against it.
To help measure the effectiveness of the efforts above, businesses need to set KPIs to track organizational and individual behavior. These KPIs need to relate back to the overall business objectives and the set risk tolerance. Below, we provide some ideas to help you get started:
KPIs need to be contextual to your business and what your stakeholders care about. Whichever you choose, it’s important to position them based on what the audience cares about. For example, maybe you rolled out a new product that helped to meet cyber risk insurance requirements, resulting in a discount compared to the previous year. If presenting it to the CEO, you can highlight the cost savings related to the expense of the product and how it helped to mitigate cyber risk.
When it comes to training, there are the table stakes items that every team across every level of the organization should take including regular cybersecurity awareness training and phishing tests. Beyond those, additional training needs to be aligned with the respective roles and responsibilities of the individual, as well as the products they work with on a regular basis.
For most executives and management, there should be ongoing education to help them understand how their respective departments can help mitigate the business’ security risk. As an example, the security team should coach accounting leadership on why their team needs to multi-factor authenticate into accounting software. There also needs to be regular reminders across communication channels on the process for vetting and selecting a new vendor, ensuring that the security team is involved in the decision-making process to avoid introducing unnecessary third-party risk.
With the security team, it should be highly customized to their respective role. A SOC analyst, for example, should be trained in how to threat hunt, run queries in the Security Information & Event Management (SIEM), and properly run a case investigation. The training for someone on a detection engineering team, however, might include more around ethical hacking, reverse engineering malware, and ways to leverage machine learning to increase detection coverage. Other roles, such as the leader of a red team, might require presentation training to ensure they know how to effectively communicate the findings.
A mature cybersecurity program combines people, process, and technology to defend against cyberattacks. At the end of the day, your security posture is only as strong as your weakest link. If you’d like to learn more about how these three pillars interact, download our Security Maturity Model by clicking the button below.
