Cybersecurity professionals offer 4 tips to help protect your business

Immersive Labs polls 35,000 cybersecurity team members and releases report on how to keep your business safe from cyber threats

As the number of malware and ransomware attacks continues to rise, cybersecurity is more important now than ever. Immersive Labs has released their findings after polling 35,000 cybersecurity team members in the last 18 months, and has boiled its findings down to four key tips to keep your organization safe from threats.

“The insights produced by this report underscore the need for large organizations to have visibility of the cyber capabilities of their workforce,” said James Hadley, CEO of Immersive Labs. “Without measuring the ability of technical and non-technical teams to mitigate risk, a critical part of resilience is missing. Gaps in cyber knowledge, skills and judgment can have the same impact as technical vulnerabilities.”

1. Understand security crisis response

One of the biggest keys when it comes to fighting cyberattacks and potential hacks is organizing IT teams and streamlining responses, making sure everyone is on the same page. As an enterprise, it is important to make sure there is no uncertainty when it comes to cyber threats for crisis response teams. Seven out of the top 10 least confidently answered crisis scenarios revolved around ransomware, and nearly 20% of the teams who faced a ransomware scenario decided to pay the requested ransom even as official guidance said not to.

SEE: Google Chrome: Security and UI tips you need to know (TechRepublic Premium)

Rebecca McKeown, director of Human Science at Immersive Labs, has likened the fight against hackers to a constantly evolving puzzle that challenges IT teams with response times and the capability to react to ever changing threats.

“The data on the time gap between threats breaking and people having the ability to defend against them shows a need for faster time to human cyber capability for large organizations,” said McKeown. “Without this, people will potentially be making decisions founded in unhelpful biases. Cybersecurity presents a unique skills development challenge for humans. Responding to a hybrid real-world and digital battlespace which is always changing means continuous skills development is crucial to preventing skills decay and building cognitive agility.”

2. Be resilient

With the barrage of attacks businesses are facing constantly, it is important that IT teams are able to adapt to quickly changing threats. A few important factors in businesses remaining tough against potential hacks are:

• Understanding the malicious code and how it is run
• Using cybersecurity knowledge and judgment when it comes to threats
• Reaction time against potential attacks
• Analyzing vulnerabilities
• Finding ways to mitigate the threat

An important way that IT decision-makers can ensure their teams and departments are up to the task of resisting cyber threats is ensuring that every step of the chain is prepared for an attack and has been capable in prioritizing knowledge, skills and judgment development against high-profile threat groups. Making sure that each member of the team is growing and emerging in their specific roles allows for less gaps in IT knowledge when it comes to confronting threats.

As an example, the supply chain attacks suffered in the SolarWinds attacks were built nearly eight times quicker than average, according to the study.

3. Prioritize human capabilities when securing applications

As the security of applications faces challenges from human capabilities, knowledge gaps in many enterprises stifle human capabilities, increasing the risk that a system or app may be targeted. In some cases, guaranteeing that the IT team is familiar with the programming language used can make a big difference in the level of security a system has. Python was predominantly noted as the most used in programming, with 31% of respondents saying their systems use the language, and Java was ranked as the second most used language at 29%.

On average, application security teams develop these human capabilities quicker than they are typically developed by cybersecurity teams. According to the report, 78% of all application security skills are developed faster than their expected completion time, compared to just 11% of cybersecurity labs finishing ahead of schedule.

4. Continually replenish talent

While it is important that current IT professionals are well informed about matters of cybersecurity, making sure that an influx of new and upcoming talent in tech has become just as important, according to the report. Ensuring that these new employees are mentored properly and guidance the potential career paths workers available can also lead to more diversity within the sector as well. Providing access to skills development for these new IT professionals will also create an ever replenishing workforce within the organization, as long as the needs of these workers are consistently met.

SEE: Password breach: Why pop culture and passwords don’t mix (free PDF) (TechRepublic)

According to Immersive Labs findings, infrastructure hacking and reconnaissance had the highest engagement rate of skills being obtained outside of the basic fundamentals of the role. On the other side of the spectrum, application security skills saw the lowest level of engagement, with just 0.5% of tasks being performed specifically for security. This lack of security knowledge for new, incoming employees could signal a potential problem down the road if the talent pool is not properly imbued with the proper know-how to defend against attacks.

In attempting to replenish the IT talent pool, it is opined by McKeown in the report that appealing to new workers could be as simple as identifying interest in the basic skills needed for the industry. These potential new hires could be the future of security within the industry, so it is crucial that their growth within the IT field is being constantly nurtured and properly stimulated.