Annual Cybersecurity Audit: Why It's No Longer Sufficient and What to Do Instead

Cybersecurity has become a critical concern for businesses of all sizes. With the increasing number of cyber threats and the potential for significant financial loss, CEOs must understand overall risk and their organization's cybersecurity measures. Traditionally, conducting an annual cybersecurity audit was considered sufficient to address these concerns. However, as technology evolves rapidly, so do the tactics employed by cybercriminals. Hence, relying solely on an annual audit is no longer enough. I will share with you why the traditional approach falls short and 7 proactive measures CEOs should consider instead. 

Why do Annual Audits Fail? 

While an annual cybersecurity audit provides some level of reassurance, it fails to keep pace with the ever-evolving threat landscape. Here are a few reasons why: 

1. Annual Audits Fail to Address Threats in Real-Time:

   Annual audits provide insights into vulnerabilities at a specific moment in time. However, cyber threats are constantly emerging, and waiting a full year between audits leaves organizations vulnerable to emerging risks. 

2. Annual Audits Fail to Analyze Emerging Attacks: 

   Audits focused solely on historical data often fail to address new attack vectors and vulnerabilities that emerge between audits. By the time weaknesses are identified, cybercriminals may have already exploited them, causing substantial damage to data, profits, and reputation. 

3. Annual Audits Fail with a Focus on Compliance: 

   Traditional audits primarily aim to meet regulatory requirements rather than proactively safeguarding against emerging threats. While compliance is important, it shouldn't be the sole focus of cybersecurity efforts. 

Moving Towards a Proactive Approach 

Trust, reputation, and even the ability to do business are becoming front and center reasons to do cyber security, by caring for your customers as you'd want them to care for your data. To enhance cybersecurity resilience, CEOs should adopt a proactive strategy that goes beyond annual audits. Here are 7 key steps to consider: 

1. Retain a Qualified CISO: 

   Having a qualified Chief Information Security Officer (CISO) is paramount for effective cybersecurity management. The CISO oversees cyber activities on a weekly basis and reports directly to the CEO, board, and general counsel. Their expertise and experience in handling cyber threats and implementing necessary measures can significantly enhance your organization's security posture. 

2. Maintain a Written Information Security Policy and Incident Response Plan: 

   A written information security policy serves as a guiding document for your organization's cybersecurity practices. It should be reviewed and updated annually to address the evolving threat landscape. This policy outlines the rules, responsibilities, and procedures that your employees must follow, ensuring everyone understands the importance of safeguarding sensitive information. Preparing for a cyber incident is just as important as preventing one. Developing comprehensive incident response plans and business continuity strategies ensures organizations can respond swiftly and effectively to mitigate any potential damage. 

3. Implement Weekly Vulnerability Management: 

   Regular vulnerability management is crucial to identify potential weaknesses within your IT environment. Your IT team should conduct weekly reviews with the entire staff to assess any vulnerabilities and promptly address them. By staying vigilant and proactive, you can minimize the risk of cyber attacks and keep your systems secure. 

4. Conduct Security Awareness Training and Phishing Tests: 

   Investing in security awareness training for your employees is a vital step towards creating a strong cyber defense. Monthly training sessions provide your staff with the knowledge and skills to recognize and respond effectively to security threats. Regular phishing tests also serve as a valuable tool to gauge awareness levels and identify areas that may require additional training or reinforcement. 

5. Leverage SIEM and SOC for Real-Time Data Protection:

   A Security Information and Event Management (SIEM) system, coupled with a Security Operations Center (SOC), offers real-time protection for your data. This 24/7 monitoring ensures that any potential threats or breaches are detected and addressed promptly. By leveraging these technologies, you can stay one step ahead of cybercriminals and mitigate the risks associated with data breaches. 

6. Conduct Regular Vendor Management Assessments: Your organization's cybersecurity is only as strong as your weakest link.

   Regular vendor management assessments should be conducted every quarter to evaluate their access to data and their security practices. Ensuring that your vendors adhere to stringent security protocols is essential for protecting your business from potential vulnerabilities introduced through third-party relationships. 

7. Perform Penetration Testing and Threat Hunting:

   Penetration testing, performed at least once a year, helps identify vulnerabilities in your systems and applications. Additionally, regularly conducting threat hunting exercises allows you to proactively search for indicators of compromise and potential threats within your network. These proactive measures will enable you to strengthen your defenses and respond swiftly to emerging cyber threats. 

Conclusion:

As the cyber threat landscape evolves at an alarming rate, relying solely on an annual cybersecurity audit is no longer sufficient for CEOs. Implementing these seven crucial steps will go a long way in safeguarding your business against cyber threats. Ensuring you have a qualified CISO, an up-to-date information security policy, vulnerability management practices, security awareness training, SIEM and SOC capabilities, effective vendor management, and regular penetration testing and threat hunting will significantly enhance your organization's cybersecurity posture. 

By prioritizing cybersecurity and creating a culture of vigilance, you can protect your business, customers, and stakeholders from the devastating consequences of cyber attacks.  

Prepare now to protect your revenue and reputation. 

Reach out if you want more help.

Spending Too Much on Licenses? Simplify License Management in Your A&E Firm to Save 15%

The Problem: Rising License Costs and Confusion 

As an executive of an A&E firm(perhaps a CFO or COO), you are likely aware of the significant investment required to maintain licenses for essential software tools. These software packages play a crucial role to accelerate design processes, collaborate with partners, and manage documents within your company. However, the cost of maintaining multiple versions of these software packages adds up quickly, affecting your overall budget.

The main architecture & engineering (AE) packages (including Revit, Civil 3-D, and Bluebeam Revu) can have a price tag of up to $12K+ per person per year! Juggling which version of software to use can confuse staff and software updates can disrupt work. 

But with a C-level consolidation strategy, AE firms can save a minimum of 15% on license costs. At slashBlue, we’ve seen that a consolidating strategy works for firms from 20-2000 employees. 

Get a free license consolidation and change management strategy.

The Solution: Embrace Simplification 

To overcome the challenges of rising license costs and the pace of change, it's time to simplify. By reducing the number of software versions your firm uses, and when you update them, you can achieve substantial savings in cost and increases in staff productivity. Here's how: 

1. Sequence the Workflow: Assess the steps your A&E firm takes to create work product. Identify the key activities your team performs to accomplish results. Eliminate those that do not provide value. 

2. Streamline Software: Identify the key software functions your team leans on to create designs and diagrams. Consider the software versions being used and determine if there are any redundancies or overlapping features across different packages. 

3. Standardize Versions: Once you have identified the overlapping features, consider consolidating licenses. Choose the fewest versions of software needed to meet the majority of your firm's requirements. This will eliminate the need to purchase and maintain licenses for multiple versions, resulting in cost savings. Explore bundled subscription-based models offered by software partners. When you have a partner who can aggregate all your software, you can ensure your A&E firm stays up to date while controlling license costs. 

4. Strategize Change: Identify the releases and updates for your firm that will have the biggest positive impact on productivity. Eliminate lesser releases unless they have necessary security updates. By reducing the amount of change, you will help your staff maintain productivity. Further, having everyone on the same version of software will reduce the likelihood of incompatibility and disruption.  

The Benefits: Cost Savings and Streamlined Operations 

We've helped numerous firms accelerate savings and consolidation while working with internal committees to manage the change. By reducing the number of software versions in your A&E firm, you can unlock several benefits: 

1. Save Cost: Eliminating redundant software versions allows you to allocate resources where they will have the greatest return, resulting in money saved on license costs. Saving an average of 15% on software expenses has a direct, positive, impact on your firm's bottom line. 

2. Streamline Change: Consolidating licenses and standardizing software versions across teams streamlines the way teams communicate, collaborate, and manage projects. When updated software is installed for all staff at the same time, everyone is working on the same platform, reducing errors with design documents, and improving overall efficiency. 

In Conclusion 

As an executive of an A&E firm, you want to make the most of your budget without compromising productive output. By reducing the number of software versions used in your organization, you can reduce costs while streamlining staff work. Evaluate your firm's software requirements, consolidate licenses, negotiate with vendors, and consider subscription models to crack the code and save an average of 15% on license costs.

For 100 software users, that saves ~$180,000!  

Embrace simplification and empower your firm to thrive in today's competitive market. 

Take advantage of our offer for a free consolidation and change management strategy, which includes a license conversation.

What is a Security Awareness Training Program for your Employees?

You probably have heard of security awareness training, had it recommended to you by a partner or IT professional, or maybe you're considering a cybersecurity strategy that includes it as part of a larger offering. What you might not know is why security awareness training is so important in your organization's fight against cyber attacks. The importance of security awareness training for your employees cannot be overstated. It is a critical element of a holistic cybersecurity strategy that, when implemented effectively, significantly reduces an organization's vulnerability to cyberattacks. 

The Human Element in Cybersecurity 

In the realm of cybersecurity, it's often said that:

"You're only as strong as your weakest link."

Unfortunately, the weakest link is often a well-intentioned employee who may inadvertently compromise an organization's security. Cybercriminals continually evolve their tactics, becoming increasingly sophisticated in their efforts to exploit human vulnerabilities. Phishing campaigns, social engineering attacks, and password-related breaches are just a few of the many tactics hackers use to target employees. 

Given this reality, it's imperative that organizations acknowledge the human element in cybersecurity. This is where security awareness training becomes crucial. 

What is Employee Security Awareness Training? 

Security awareness training is an educational program designed to equip employees with the knowledge and skills needed to recognize and respond to cybersecurity threats. When done properly a security awareness training program will provide employees with an understanding of the role they play in protecting an organization against security threats. Security awareness training helps to raise awareness of potential threats as well as emerging threats all with the goal of changing user behavior. 

A robust security awareness program should cover a range of topics, including: 

1. Phishing awareness: Teaching employees how to identify, avoid, and respond to suspicious emails or messages, including spear phishing. 

2. Password management: Educating employees on the importance of strong, unique passwords and the risks of password sharing. 

3. Social engineering: Raising awareness about the tactics used by cybercriminals to manipulate individuals into disclosing sensitive information. 

4. Safe web browsing: Instructing employees on how to navigate the internet securely and avoid potentially harmful websites. 

5. Physical Security: Educating employees on the security risks physical access can have on an organization’s efforts to avoid a data breach or loss of intellectual property. 

The Importance of Security Awareness Training 

1. Mitigating Human Errors: The most significant benefit of security awareness training is its ability to reduce human error. Employees who are well-informed are less likely to fall for phishing attempts or engage in risky online behavior. This results in a lower likelihood of security breaches due to unintentional actions. 

2. Enhancing Security Culture: Security awareness training fosters a culture of cybersecurity within an organization. When employees understand the importance of security and their role in it, they become active participants in protecting the organization's digital assets. 

3. Cost Savings: Preventing a cybersecurity incident is far more cost-effective than dealing with the aftermath of a breach. By investing in training, organizations can save themselves from the financial damages and loss of brand reputation from a cyberattack. 

4. Compliance Requirements: Many industries have regulatory requirements to implement security awareness training as part of their compliance efforts. Failure to do so can result in fines and legal repercussions. 

5. Anti-phishing Techniques: Understanding the impact phishing attacks have on an organization’s security posture. This includes running phishing simulations and deploying phishing tests.  

Security Awareness Training as Part of a Holistic Strategy 

While security awareness training is critical to empowering employees to take ownership of an organization's information security, it's important to note that security awareness training alone is just one piece of the puzzle. A holistic cybersecurity strategy encompasses various components, including: 

1. Assess and Oversee Policy: Creating a WISP (written information security policy), adopting those security practices across the organization, and making recommendations based on an organization's unique requirements.  

2. Plug and Watch for Weaknesses: Continuously monitoring activity across the organization's entire network looking for attacks in real time. These scans are focused on password security, movement of sensitive data, and access to personal information often stored in human resources databases.  

3. Educating Staff: Implementing a successful security awareness program focused on an employee's role in protecting the organization.  

4. Detect New Weaknesses: Scanning an organization's assets to determine attack vectors cybercriminals could use to gain access and remediating known vulnerabilities to limit the likelihood of data breaches. 

5. Manage Vendor Weaknesses: Reduces the frequency and severity of data breaches, data leaks and cyber attacks involving other organizations in protecting sensitive data. This approach involves assessing an organization's unique vendor list and performing due diligence on the delivery of goods or services.  

6. Test for Weaknesses: Once all other measures have been put in place a penetration test is required to help discover new vulnerabilities. During penetration testing security professionals will simulate an attack by trying to break into the organization's network and report back on the pathways used to access the network.  

   For more information, see the 7 Strategies that help protect revenue.

By integrating security awareness training into this broader cybersecurity framework, organizations create a multi-layered defense against cyber threats. When employees become the first line of defense, working in tandem with technical safeguards and policies, the chances of a successful attack are significantly reduced.  

In conclusion, a security awareness training program is an essential component of a holistic cybersecurity strategy. It empowers employees to recognize and respond to threats, thereby reducing the human error factor in security breaches. By integrating cybersecurity awareness training into an overall cybersecurity framework, organizations can effectively safeguard their digital assets, protect their reputation, and ensure regulatory compliance. In an age where the cyber threat landscape continues to evolve, investing in the education and awareness of employees is a prudent and strategic move that no organization can afford to overlook. 

 See how slashBlue can help

CMMC 2.0 Strategy Briefing: Rulemaking Ready

The Cybersecurity Maturity Model Certification(CMMC) final rule-making process has been kicked off for architectural and engineering firms that do business with the Department of Defense. The CMMC rules are submitted and will be published by the Office of Information and Regulatory Affairs within 90 days. We can expect CMMC 2.0 to be published by October 2023.

The biggest delays in the published date are now behind us. The CMMC model version 2. 0 has been released, and it incorporates feedback from industry stakeholders and enhances the requirements and practices for each CMMC level. The important point is that the submission of the final rule to the office of management and budget OMB is done. It's still a bureaucratic process like we've seen in the past, but now it's less fraught with delay than previous phases.

Next, OIRA will decide how to publish it, and will likely make CMMC 2.0 a proposed rule making it effective in 2025. However, OIRA may make this an interim final rule, making it effective in 2024. They rarely do this, but according to the rule book, when an agency publishes a final rule, the rule is usually effective no less than 30 days after the date of publication in the Federal Register.

If the agency wants to make the rule effective sooner, it must cite good cause in the public interest. This has happened a few times in the last several years, so be aware of this possibility. In addition, be prepared for a comment period, specified by the agency, that lasts from 30 to 60 days.

Most importantly, implement CMMC now while acquiring contracts for 2024 and 2025.

Here is what you can do:

1. Have a true chief information security officer(CISO) review the version of the CMMC rules submitted for OMB review. Do this with yourself and your CMMC assessor.

2. Assess your business case for acquiring and retaining government contracts using CMMC 2. 0. Know what your business has to gain, what you have to lose, and the timing of opportunities.

3. Assess your timeline and whether your implementer and auditor can accomplish the work in time and within the costs of your business case.

4. Stay tuned for news on the review process. It's becoming public, and we'll know more in the coming days.

If you'd like more insights like this, Please join my free private group for architecture and engineering firm executives:

https://www.linkedin.com/groups/8272471/

See how you can protect millions in revenue for your firm

7 Strategies to Protect Millions in Revenue and Maintain Client Trust

The Problem:

1. Annualized revenue of $20 million, but $3 million was dependent upon cybersecurity requirements.

2. Starting cybersecurity maturity score: 35.

A firm’s Managing Director made a personal promise to clients that their firm would implement cybersecurity practices according to the client’s requirements to gain the business. The reputation of the firm, as well as millions of dollars in contract value each year, were at stake. 

He understood that they needed cybersecurity measures that not only met their own requirements but also fulfilled the complete set of requirements of all their customers. This meant it was more complex than just avoiding ransomware and downtime. It required oversight to ensure compliance with customer requirements. 

How They Increased Cybersecurity Maturity:

The firm implemented an oversight strategy including many of these items.

1. Assess & Oversee Policy:

• Assess business-specific risks rather than following the generic practices of a managed service provider. 

• Use a publicly defensible framework to build trust with customers while implementing a Written Information Security Policy (WISP). 

• Protect revenue, reputation, and data with transparency for client trust. 

2. Watch for Weaknesses:

• Implement redundancy and long-term logging to detect breaches by deploying SIEM/SOC and MDR in the cloud and on-premises. 

• Raise awareness of the most important business risks through AI assisted risk alerting and incident response. 

3. Educate Staff:

• Lower the risk of phishing attacks with engaging training videos. 

• Audit and follow up on training to address current staff risks.

4. Detect New Weaknesses:

• Identify insecure data pathways and storage mechanisms. 

• Use AI powered event management to find new risks. 

• Harden new risks to the network and map data flow. 

5. Manage Vendor Weaknesses:

• Audit vendors' access to data and evaluate their maturity and ability to protect information up and down the supply chain. 

• Lower the likelihood of a breach through vendor risk management.

6. Test Weaknesses:

• Test what's been done for quality oversight.

• Conduct penetration tests.

7. Use Qualified Oversight:

• Select a battle-tested cyber information security officer (CISO) who has protected thousands of people for many years. 

• Have the CISO report to the CEO ideally, else the CFO or general counsel. 

The Result:

Annualized revenue protected: $3 million per year and growth requiring cybersecurity maturity total revenues of $20 million per year protected from disruption.  

Ongoing Cybersecurity maturity score moved from 35 to 73, surpassing the customer requirement of 70. 

Within three months of implementing slashBlue cyberSecurity Oversight, our client demonstrated the ability to meet the target cybersecurity maturity requirements for both their firm and key clients. 

• The firm has ongoing reporting that gives confidence in meeting customer cybersecurity requirements. 

• In the event of a cybersecurity incident or breach, the firm is fully prepared to protect customer data. 

• By prioritizing customer protection, the firm safeguards revenue generation. 

• The firm leaders can now sleep better at night with greater peace of mind. 

Reach out if you would like help.

Top 5 Risks of Business Disruption in 2023 (And 5 Strategies to Mitigate)

Alliance published its risk barometer for 2023.  According to the report, cyber and business interruption top the list of threats, economic and energy risks rise.

Cyber incidents and Business interruption ranked as the foremost company concerns for the second year in a row. Macroeconomic developments such as inflation, financial market volatility and the threat of recession, shortage of skilled workforce, and natural catastrophes round out the top five for the United States.  View the full global and country risk rankings.

Here are five strategies you can use:

1.     Business interruption - Plan for disruption and establish alternate channels in your supply chain. Tune up your disaster recovery and business continuity policy.

2.     Cyber incidents - Review your product and services to establish cybersecurity as part of your strategy for acquiring and retaining clients.  Cybersecurity capability is now a possible competitive advantage to build trust in the marketplace. Of course, you also want to make sure that your cybersecurity policy is clear and tested.

3.     Macroeconomic developments - Tune your value proposition to accommodate inflationary pressures on your pricing while making sure you're delivering the value that your customers need in changing market conditions.

4.     Shortage of skilled workforce - Establish repeatable and scalable processes, teaching your employees how your company delivers value. Make sure they have the right technology tools and software solutions to do their job. Even more importantly, make sure that they know when to use software and when not to. All of us get too many emails and thoughtless communications. Let's simplify the technology we use.

5.     Natural Catastrophes - Get insurance against catastrophe. Prepare for disruption to business with a full sales pipeline so that if you have supply chain or natural disaster disruption, you can redirect resources to other areas of revenue generation.

Whether you are the CEO, CFO, COO, President, or Managing Director, make sure to take the time to assess and plan for risks as part of your strategy for 2023 and beyond. Reach out if you would like help.

Equifax Security Breach: The Top 3 Ways to Protect Yourself

In another cybersecurity breach, 143 million U.S. consumers may have had their identity information stolen from Equifax.

The identity thieves make money selling your information to people who could potentially take out credit cards or loans in your name.

Take action to protect yourself and those you love.

Here is what we recommend for every consumer to protect themselves from this theft:

1)    Check to see if your information was known to be stolen. Check your name at Equifax on the web or call 866-447-7559.

2)    Take action to protect your identity.  To be the most secure, many recommend placing a “credit freeze” on your credit report with Equifax, Innovis, Experian and Trans Union.

a.     See the Federal Trade Commission's Credit Freeze FAQ

b.     Check out some free services Equifax is offering to help. 

3)    Stay alert. Keep an eye on bank accounts for suspicious activity. The hackers got information because Equifax was insecure.  It was not something you did. While, it was not because of a phishing attack, phishing remains one of the top ways to have identity information stolen.

If you want to know what should be on your Cybersecurity Roadmap, schedule a free consultation now.

Password Manager Breach – How do you know you are secure and What to do about it? (OneLogin)

The recent OneLogin breach is very serious. When a password manager gets hacked, it's not as though you only have your user login and password to worry about. Password managers store more than just basic password information. They include login information, identity, credit card, health information and more.  Cloud service providers use these password managers. So, with the OneLogin breach, it's not just their passwords that are on the line, it is all of their clients information. (Including yours if you have a service provider that uses them)

It seems like there is no one immune to a hack. It's just a matter of time. 

How much trust should we place in password managers to store this information?

What companies can we trust out there?

Here's what you can do to protect yourself:

1. Use a password manager, but only one that offers two-factor authentication AND encrypts data locally (e.g. Lastpass)
2. Select Cloud Service Providers and Managed IT Support with a Cybersecurity plan that uses two-factor authentication AND encrypts data locally 
3. Ensure that your IT partners have Cybersecurity and Data breach insurance

Password managers are a great tool to protect yourself and your company. It is technology that protects your purpose. Remember, there is no way to be 100% secure online.  If you store information online, it may become public someday.

If you need help with a Cybersecurity Technology Roadmap, find out more.
If you want to get a free month of Premium Lastpass, click here.

May the Fourth be with you - 5 Great Star Wars Technologies

When Star Wars came out in 1977, it shocked the world with amazing space battles, realistic special-effects and mind blowing sound.

The desire to create and make better movies, pushed the technology.

The imagination and drive of George Lucas, and his team, created many new technologies that made the story come alive on screen.

A STAR WARS DAY MESSAGE FROM NASA

Here are 5 of the technologies they created: (according to Rotten Tomatoes)

1. The Dykstraflex - This special camera allowed filmmakers to replicate repeated camera movements for amazing space battles.
2. Computer animation -  Star Wars gave us 3D wireframe animation.
3. Go Motion - Better than stop-motion, go-motion used computer controlled puppets to mimic more realistic movement.
4. THX sound - THX sound has become an industry standard for movies.
5. Blue screen – The blue screen provided much greater realism than fake-looking rear projection. Blue screen set the bar for special effects in the modern era.

Let your inner George Lucas out and get to your mission faster with great technology.

The technology makes the purpose possible.