“Shark Tank’s” Robert Herjavec feels that when it comes to a strong security strategy, it’s all about your process and keeping your cool.
What is the largest security threat that businesses face currently?
In the case of cybersecurity, having visibility in your entire infrastructure is key. Too many companies have a whack-a-mole cybersecurity strategy. They focus on the immediate security problem but don’t address the bigger picture, and that’s a huge risk. You can focus on preventing a ransomware attack, training your employees about security awareness, and enhancing your firewalls, but you can’t make any one effort in a silo. By taking a step back, identifying your crown jewels, and developing a layered protection plan that supports 24/7/365 visibility, you can take on the consistently evolving threats facing all enterprises today.
How can they better prepare to face this threat?
People, process, and technology are key to any cybersecurity strategy. As organizations work to refine their security program, they can start off by getting back to basics – practice good cyber hygiene, patch your systems, test defenses and processes, conduct tabletop exercises, perform vulnerability scans, and hunt for threats. I have been running my cybersecurity firm, Herjavec Group, since 2003. The security landscape looks nothing like it did two years ago, let alone 16 years ago. But one thing never changes: our need to proactively prepare for an incident. We highlight a 10-point plan for our customers about security preparedness. We start at a framework level and work down to the specific business challenges and risks to pinpoint potential vulnerabilities and gaps in visibility.
Understand what is critical, important, and meaningful at your business. Document where those important things are stored, how they’re protected, and what the cost and impact is if they’re lost or stolen. Create policies, procedures, and guidelines for handling information security incidents. Create practices for communication, involving your legal departments, staff, law enforcement and customers. Ensure you have visibility into the critical activity and behavior in your environment. Make incident detection and analysis a core competency for your information security program. Find a balance for your program goals and spending between preventative, detective, and corrective actions, and remember that preventative controls will fail. Develop and understand your capacity for response. Hire, contract, or allocate resources that are trained, and have the necessary tools and experience in incident response. Develop a plan and process to understand and react to extended incidents, or major incidents that exceed the skill level and capacity of internal staff.
What is one new advancement in cybersecurity about which you are excited?
I love our business and our industry. It’s constantly changing. Being able to have better intelligence — often using artificial intelligence — and leveraging big data analytics will change the security landscape for the next five to 10 years. We’re also placing an immense focus on our identity services. You want to understand who is accessing your data, why, for what purpose and for how long. We focus on setting up a data warehouse for our customers, then specializing further into privileged access and cloud requirements. We’re also seeing increasing demand for Managed Detection and Response services. This extension of Managed SIEM has come to rise because enterprises want an orchestrated response to threats: faster time to value, hands-on support, active hunting. It makes sense.
What’s one piece of advice you want to give to business owners about security breaches?
When you’re in the midst of an incident, you tend to panic, so you want to engage a partner who can bring a sense of calm to the situation. Bring in someone who has been there and knows how to guide you. Even more importantly, all businesses should be talking often about cybersecurity. Cyber is no longer an IT conversation; it’s an executive priority and every employee’s responsibility.