Essay Example on Breach Avoidance: It Can Be Done, It Must Be Done

The article titled Breach Avoidance: It Can Be Done, It Needs to Be Done by John Pescatore looks into security breaches on business organizations and how they can be avoided. While some breaches expose classified business and customer information, others are capable of bringing down operations. According to Pescatore, breaches are not unavoidable. There are modern techniques that both small and large companies can use to avoid or fend off most cyber attacks. The techniques can be applied by even companies with limited budgets and staff, and significantly minimize the damage caused by successful breaches.

Is your time best spent reading someone else’s essay? Get a 100% original essay FROM A CERTIFIED WRITER!

Save 25%

One thing to learn from the article is that taking action is the best strategy when it comes to avoiding security breaches. An organization's cyber security team has no control over threats. Hackers will always initiate attacks as long as they have motive and time. They are always in possession of highly sophisticated mechanisms of doing it and evasion techniques. The article's author also points out that software will always have vulnerabilities. There may be actions that security teams may use to mitigate and avoid some vulnerabilities. However, the reality of hacking and phishing is that attackers will always discover new vulnerabilities. Simply put, the risk-increasing aspect of any mitigation action cannot be controlled. Risk increases whenever hackers launch and improve attacks or when errors in IT operations result in vulnerable systems.

What can be controlled are the risk-reducing aspects of mitigation actions. All security teams have to do is understand the impact of breaches on business, express risk in terms of that impact, and figure out how improving security minimizes the negative impact. They need to develop situational awareness that involves an accurate and timely knowledge of what needs to be protected, any existing vulnerabilities, and the real threats posed on those targets. They can them combine that awareness with the tools and techniques needed to carry out mitigation and prevention actions. By doing this, security teams can take fast actions to avoid the most damaging breaches and significantly minimize the damage to business caused by unavoidable incidences.

Another thing learned from the article is that the key to mitigating breaches lies in implementing the right proactive actions as opposed to more actions. Some companies tend to just add more security measures and products, a strategy that invariably increases complexity and costs. Over the years, there has been little or no correlation between the amounts spent on security and the level of damage to business caused by breaches. Merely adding more security products makes systems even more complex. This means a company has to hire security staff with skills that are hard to find, often resulting in more disruption to operations than caused by breaches. The organizations that experience the least damage from attacks are invariably those with strong security teams capable of avoiding the most vulnerabilities. They achieve this by proactively conducting their IT operations in a way that minimizes vulnerabilities in their systems and applications. It is virtually impossible to avoid all weaknesses in IT systems. Prioritizing security products and services as well as staff resources to deal with areas experiencing the biggest and most frequent risks is the key to efficient cyber security.

The article's author recommends several steps that can be taken to avoid breaches within business organizations or entities. One of them involves using cyber security to protect the business rather than to comply with rules and regulations. Most damaging security breaches have occurred to entities that have been given a clean bill of health by auditors. However, compliance with the law does not amount to security. It simply means that a single-instance assessment for a general-purpose criteria showed that there were no observable vulnerabilities. Simply attaining compliance may put the company on the right side of the law, but it will not assure action protection of classified information. Also, compliance has never been known to offer any liability reduction or legal cover if breaches do occur.

The best way to prevent breaches is to install a cyber security framework that prioritizes controls and actions based on the risk posed to the business. The framework will focus on the security measures and processes that are most crucial in avoiding breaches capable of exposing customer information or disrupting business operations. Compliance standards may include all security controls that can prevent breaches. However, good frameworks enable security teams to focus on areas that are most likely to minimize business damage.

Another recommendation involves setting up accurate and continuous monitoring of potential security breaches. Security teams cannot protect system elements that they are not aware exist. The staff needs to know which systems, data and applications are being used by the business. They need to have timely and accurate information on vulnerabilities that may occur due to security gaps such as misconfigurations or missing patches. Such knowledge would facilitate proactive efforts to shield or mitigate system before an attack is launched. Regular checks for vulnerabilities may comply with the law, but it is almost never enough. Network-based assessment tools are generally required to assure accuracy of inventory and vulnerability data. Similarly, security teams need real-time knowledge of business operations linked to IT components to risk assessments is done to all critical systems.

There are several other steps not mentioned in the article that business organizations and entities should incorporate to reduce the risk of loss of stakeholder or company assets within the organization. One involves limiting access to the company's most valuable data. A few decades ago, each employee had access to virtually all the files in their computer. Nowadays, organizations have learned the hard way to restrict access to the more critical data. For instance, a mailroom employee has no business going through clients' financial information. By limiting access to certain information, the company narrows down the pool of staff members who might inadvertently click on a malicious link (Sloan & Warner, 2019).

Another step to mitigate security breaches involves vetting all third-party vendors. Every organization interacts with a wide range of third-party contractors. According to Chun (2019), it is of great importance than ever to find out who such individuals are and whether they can be trusted. For example, a freelance programmer contracted to install a certain program in an organization's server could have a criminal record. A company needs to limit the kind of information that these vendors can access. Such precautions may mean a lot of work for the company's IT department. However, it could prevent a potential data breach that could cost the business millions of dollars. For third-party vendors allowed to access sensitive data, the company should demand for transparency. It should ensure that such vendors comply with privacy laws. The organization can also conduct background checks on vendors contacted to it on a regular basis.

References

Chun, S. H. (2019). E-Commerce Liability and Security Breaches in Mobile Payment for e-Business Sustainability. Sustainability, 11(3), 715.

Hemphill, T. A., & Longstreet, P. (2016). Financial data breaches in the US retail economy: Restoring confidence in information technology security standards. Technology in Society, 44, 30-38.

Pescatore, P. (2018). Breach Avoidance: It Can Be Done, It Needs to Be Done. Retrieved from https://www.sans.org/reading-room/whitepapers/riskmanagement/breach-avoidance-done_38585

Sloan, R. H., & Warner, R. (2019). How Much Should We Spend to Protect Privacy: Data Breaches and the Need for Information We Do Not Have. JL Econ. & Pol'y, 15, 119.