Security should be built into the culture of an organisation, and that should be felt all the way through the implementation of a security plan.
Every business should consider putting a security strategy in place to avoid becoming vulnerable to risks, and it is also important to make sure that all staff are aware of all the ins and outs.
So whether you're thinking about it, or are in the middle of a security plan implementation, you should read our top tips.
Read next: 7 of the best security tools for your home office
By CIO UK Staff
April 23, 2019
1. Why is a security plan important for a CIO?
The hybrid nature of the CIO role can mean you're spread pretty thin, but you will be expected to deliver on both business and security initiatives.
Digital transformation and innovation are what most CIOs strive for, and it's these kinds of projects that tend to put cyber security on the back burner. Often, security plans can lag behind revenue-based initiatives.
Of course, some organisations will have a CISO or a security executive whose role it is to take the lead in security concerns. However, the CIO should have a close working relationship with that person and be able to advise where necessary, and vice versa.
The 2017 CIO 100 found that 70% of organisations listed had a security leader reporting to the CIO.
Kier Group CIO Duncan Scott told CIO UK: "The CIO must own the IT and security strategy and communicate it well enough to the business executives that they are able to make informed decisions. The CISO doesn't have to do that. The CISO has to implement the technical and people components of the strategy."
Read more: Kier Group CIO Duncan Stott explains how he coordinates cyber security with board and CISO
4. Security measures and controls
Businesses should have basic security measures in place to keep its data, employees and customers safe online. Simple measures such as creating strong usernames and passwords can go a long way to help secure your business.
Last year, Barclay Group Security CIO, Elena Kvochko told CIO UK that businesses need to implement strong measures at every level of the organisation to achieve true end-to-end security.
“The need for end-to-end security has given rise to the proliferation of security products,” she said. “After all, a business can only be as secure as its weakest link. It is the right tools and processes together that help enable teams to predict, prevent, protect, react, and recover from security incidents.”
5. Protect files from unauthorised access
Rarely a week goes by without a business having suffered a data making the headlines.
Last year, Pizza Hut revealed its website and app was hacked with 60,000 customers being impacted by a security breach. The hack had seen personal information such as email addresses, bank details and home addresses being stolen. And late last year Yahoo as forced to disclose that as many as 3 billion of its email accounts might have been compromised.
If data breaches are a matter of ‘when’ not ‘if, CIOs and system administrators should take steps to ensure they are detected quickly.
Two-factor password authentication meanwhile can be a cost-effective way to reduce risk from weak passwords while also educating employees on security concerns.
Ascential CIO Sean Harley says: “We are reducing the risk of people choosing simple passwords, we worked with the technical team to implement a single sign-on solution.”
8. Monitor networks
Network monitoring systems help admins understand what is going on in their network.
A network must be able to collect, process and present data with information being analysed on the current status and performance on the devices connected.
If a detection system suspects a potential breach it can send an email alert - based on the type of activity it has identified.
Antivirus software can monitor traffic and detect signs of malicious activity. These tools look for specific patterns such as byte sequences in network traffic or multiple log in attempts.
Ascential CIO Sean Harley said last year: “We focused even more heavily on information security. This has required the implementation/review of new/existing processes such as checking of our monitoring and logs for anomalies that could indicate compromise or potential threats, culminating in a new threat and vulnerability assessment which is reported to our executive team on a weekly basis.”
11. Formalise a security plan
A security roadmap will demonstrate a clear path for achievable goals.
A good security plan should include costs, objectives and goals, as well as steps for monitoring each aspect of the implementation, including employee understanding.
"It's about having every member of staff understanding the excitement and the responsibility and challenge of maintaining that infrastructure, and doing that in such a way that we can keep a high level of service not just from a technology perspective but from a security and a customer service perspective as well," Simon McCalla, former CTO at Nominet and current CEO for Sedex told CIO UK.
"We've been working behind the scenes to ensure that we can remove as many threats from .uk as possible, and some of that is stuff that we talk about openly, and some of that is stuff that we have to do quietly behind the scenes with law enforcement to tackle some of the bigger challenges, and we've been pretty successful at that," added McCalla. "This division is a kind of natural exposure of some of those skills and capabilities into a more commercial market."
Read more: How CIOs are protecting their organisations from cyber attacks
