The 3 Business Functions That Should Not Be On ‘Cybersecurity Autopilot’


How to proactively address security expertise shortages and immature detection capabilities.

April 25, 2019 • Published by


While the vast majority of a company’s business processes are dependent upon its IT resources, most leaders will admit that cybersecurity can become an afterthought. That’s because the time and money allocated toward maintaining cybersecurity checks and balances often gets redirected elsewhere.

The fact is, unless you’re a cybersecurity organization, there will always be a more pressing task than cybersecurity. There are so many moving parts within a company’s IT organization alone, that I’ve rarely spoken with a CTO or CISO who was confident all their cybersecurity bases were covered.

When cybersecurity coverage gets slim—whether it’s due to a lack of internal expertise or technology capabilities, or both—key business functions tend to go on what I call “autopilot.” Firewalls run using outdated configurations, legitimate security threats go unnoticed, and everyone is just hoping today isn’t the day an employee clicks a bad link and unleashes a crippling malware attack.

In this post I’m going to discuss the three business functions that should never be put on cybersecurity autopilot, and how to proactively address your organization’s expertise and manpower challenges.

Business Function #1: Endpoint Security

Real-time endpoint security serves as your company’s first line of defense against the human element, protecting devices like employee laptops, desktops and point-of-sale systems. Traditional anti-virus and anti-malware products have long used pattern or hash-based detection to identify previously known threats, but this is no longer an acceptable solution. Current threats require the addition of behavioral detection to truly provide protection from newer, advanced threats.

Behavioral detection includes security functions like process monitoring and analysis; disk and memory monitoring and protection; and inclusion of machine learning/artificial intelligence. The targeted attacks we see today rarely use malware variants with known patterns, so pattern detection doesn’t offer enough protection. Through behavioral monitoring, endpoint security can stop even the newest ransomware/cryptoware before it creates significant damage in your environment.

In a layered security approach, Managed Detection and Response (MDR) complements the endpoint solution that’s in place by providing a 24x7 team of security analysts who monitor, investigate and remediate threats in your environment while your team focuses on business value-add tasks. Your MSP or internal IT team will often be overwhelmed or overburdened trying to manage security on top of their other day-to-day tasks, so it’s best to evaluate and determine how MDR best fits into your environment.

Business Function #2: Network Security

In conjunction with endpoint security, you also need protection and visibility within the network via firewall, IDS (Intrusion Detection System), IPS (Intrusion Prevention System) and NAC (Network Access Controls). These measures supplement endpoint security to provide protection to all other devices in your network by identifying malicious physical activity (e.g., plugging in a rogue machine) and logical activity (e.g., internal or external vulnerability scanning, malicious malware lateral movement, DDoS attacks) on the network without having to involve the endpoint.

Network security provides correlation datapoints to your endpoint protection suites. You are able to see and understand where certain IP addresses or file hashes are identified across your network. It also enables network traffic analysis to look for anomaly detection and perform behavioral or content pattern reviews, which helps protect against malicious content like website spoofing and phishing, as well as possible IoT device breaches.

Business Function #3: Backup and Recovery

Real-time backup and recovery is your last line of defense against ransomware, cryptoware or any kind of malware that causes destruction of data. Backup and recovery should cover more than just servers. Desktops, laptops, and even cloud-based storage all need to be taken into account, along with any other storage mediums used to house your company data.

To be completed successfully, backup and recovery requires clear policies and frequent review and testing. Involved parties should know what to back up, how often and where to store the backups; how and why to encrypt backup data; and how to ensure that the backup data can be easily retrieved.

Daily scheduled backups are a must, and you must also determine whether this is done as a file-based backup, or an entire system backup. These decisions are part of your Disaster Recovery planning, as they will impact how you restore, how long it takes, and where you can restore to. For instance, if you just want to restore a specific directory, you may not want to have to restore the entire file server. It’s important to verify within your environment what is the right solution for your business to use, and to communicate your Disaster Recovery plans and expectations throughout the business.

Get out in front of your cybersecurity needs.

Real-time threat detection and response is a security imperative, but most companies aren’t equipped to handle this themselves. So how do you keep these three business functions from defaulting to cybersecurity autopilot? The answer may be to hire a 24x7 security operations center (SOC) that provides the services you need to keep your business optimized and running no matter what challenges arise.

IT is the backbone of a thriving, modern enterprise, and going through the motions without truly covering your organization’s cybersecurity needs can cause significant business disruption. Contact us today to learn more about how to avoid cybersecurity autopilot by supplementing your organization’s security threat management efforts.