WBJ: Fenoglio Contributes Expertise to 2023 Cybersecurity Table of Experts

Wichita, Kan.—(December 15, 2023)—Have you ever wondered if your business is truly secure in our vast landscape of growing digital threats? If so, you’re not alone. In fact, countless companies have the same concern.

Here’s the good news—you’ve come to the right place to find answers and insights that can help safeguard your business.

Jason Fenoglio, Cybersecurity Practice Manager at High Touch Technologies, recently participated in the Wichita Business Journal’s (WBJ) Cybersecurity Table of Experts, sharing his invaluable guidance alongside other leading local experts in the field.

The WBJ’s Cybersecurity Table of Experts, an annual feature, brings together Wichita’s top cybersecurity minds to address the pressing questions challenging Wichita’s business community. Alongside Jason, this year’s panel included John Dobbin from Pileus Technologies and Renato Untalan from Novacoast. Together, they explored critical cybersecurity topics, including:

• Current trends in cyberattacks and cybersecurity
• Risk mitigation
• Password and authentication strategies
• Cybersecurity skills and talent needs
• Vendor and third-party security policies
• Artificial intelligence
• Future of business technology and cybersecurity in the context of remote work

The insightful discussion, published in the December 15, 2023 edition of the WBJ, offers a comprehensive look at the ever-evolving cybersecurity landscape. Click here to read the full article on the WBJ’s website.

Below, you can read Jason’s unique cybersecurity insights featured in the article.

1. In the face of unforeseen disruptions, such as pandemics or cyberattacks, how are businesses enhancing their resilience and ensuring continuity in operations? What lessons have been learned from recent global events in this regard?

Many businesses are actively fortifying their resilience to help ensure operational continuity in the face of unforeseen disruptions like cyberattacks. The key to this strategy is a holistic, multifaceted approach that includes robust governance, tools, and policies aimed at achieving cybersecurity goals.

By adopting governance structures, businesses create a solid foundation for cybersecurity efforts, ensuring that strategies align with organizational objectives. Governance frameworks, such as the NIST Cybersecurity Framework, CIS v.8, CMMC, and ISO 27001, provide a structured approach to cybersecurity management, guide decision-making processes, allocate resources effectively, and establish accountability throughout the organization.

Additionally, integrating advanced cybersecurity tools is a priority—for example, tools that encompass threat detection, incident response, and vulnerability management. Businesses can leverage this technology to proactively identify and neutralize cyberthreats, reducing the potential impact of disruptions.

In tandem with governance and tools, organizations should implement and/or refine their cybersecurity policies. These policies set clear guidelines for secure practices, incident response procedures, and data protection measures. They serve as a roadmap for employees, outlining expectations and contributing to a culture of cybersecurity awareness.

This multifaceted approach not only addresses immediate threats but also builds a resilient foundation capable of adapting to evolving cyber landscapes.

2. How does an organization determine how much risk is acceptable and if the mitigation efforts are enough?

Determining acceptable risk and assessing the effectiveness of mitigation efforts is vital for an organization’s security strategy.

Organizations need to align their risk tolerance, often called risk appetite, with their business objectives—this involves weighing the potential impact of a security incident against the cost of implementing controls. Notably, a control’s cost should not exceed the value of the asset it protects. However, costs such as reputation damage and losses due to breached personally identifiable information (PII) data must be considered in this equation. This careful balance ensures cost-effective risk mitigation. Regular evaluations and adjustments to risk management strategies are crucial to staying resilient and securing assets without unnecessary expenses.

3. How does a sound password and authentication strategy contribute to the organization’s efforts in safeguarding critical assets?

In a remote/hybrid work environment, data workloads have shifted from on-premises to the cloud. To ensure the security of internet-accessible data, a multifactor authentication approach is essential.

Additionally, a strong password strategy involves educating users to create unique and robust passwords. Encouraging the use of passphrases, like memorable sayings or song lyrics, enhances password strength and memorability. Organizations can further support secure password practices by implementing an enterprise password management tool. This tool allows users to remember only one master password for their vault, with all other passwords generated and stored securely. Password managers also provide features like breach notifications, password strength analysis, and certificate-based passkeys.

For additional security when accessing internet-facing data or SaaS applications, the use of second factors such as temporary codes, hardware or software tokens, and certificate-based keys is crucial. These factors, including options like RSA tokens, software PINs, push authenticators, or FIDO 2 compatible tokens, add an extra layer of protection for sensitive access points like VPNs and SaaS applications.

4. How does a vendor and third-party security policy contribute to the overall resilience and trustworthiness of a business supply chain and service ecosystem?

Organizations should establish a security policy for all third-party vendors—it plays a key role in an organization’s risk management strategy in today’s interconnected business environment. A vendor and third-party security policy enhances the overall resilience and trustworthiness of a business by addressing security risks, ensuring compliance, fostering collaboration in incident response, and creating a secure network of partners.

This policy should outline security expectations in contractual agreements, specifying measures, reporting duties, and consequences for non-compliance. Conducting risk assessments for vendors with access to sensitive data is crucial. Requesting a security attestation, like a compliance report based on standards such as SOC 2, ISO 27001, HIPAA, HITECH, or NIST CSF, can reduce risk concerns.

5. How is an incident response process positioned within an organization to improve its overall risk management and resilience strategy?

Positioning an incident response process within an organization plays a vital role in improving its overall risk management and resilience strategy. The incident response process is like a safety net, helping the organization quickly detect, respond to, recover, and learn from security incidents. By having a well-defined incident response plan in place, you can minimize the impact of security breaches, reduce downtime, and protect critical assets. This proactive approach not only enhances cybersecurity but also strengthens the organization’s ability to adapt and withstand unexpected challenges, contributing to a more resilient and secure business environment.

An incident response (IR) plan should be created for each system and/or department where the administration or support team differs from the internal IT department. There should also be an IR plan in place for each vendor that the organization partners with because the vendor’s technical contacts will be unique for each one. The IR plan should also be practiced via a “tabletop” exercise to determine its effectiveness and validity, preferably at least once a year.

6. How can the establishment and enforcement of comprehensive policies significantly enhance the effectiveness of an organization’s technical security controls within its IT infrastructure?

Establishing and enforcing comprehensive policies is crucial for boosting the effectiveness of an organization’s technical security controls in its IT infrastructure. These policies provide clear guidelines for security measures, ensuring that all aspects of the IT system are protected—they help manage risks, define proper user behavior, and establish protocols for responding to security incidents. By aligning policies with technical controls, organizations can create a robust defense against cyberthreats, enhance overall security, and maintain the integrity of their IT infrastructure. This alignment ensures that security measures are consistent, well-understood, and effectively implemented across the organization.

An organization could spend an entire IT budget on technical controls that are aimed at protecting it; however, if the infrastructure is misconfigured, the technology will not be able to protect it. For example, an unmonitored domain administrator account that has not had its password changed for years could allow an attacker to use native tools to disrupt operations and/or exfiltrate data before the detection system could discover it.

7. What does zero-trust architecture mean to you, and how can it be effectively implemented without reducing business efficiency?

Zero-trust architecture (ZTA) is a cybersecurity approach where trust is not assumed for any user, system, or device, regardless of their location. It involves continuous verification of identity and strict access controls, reducing the risk of security breaches. This strategy promotes a proactive security stance by assuming threats can come from both inside and outside the network. ZTA is effective in safeguarding critical assets, preventing unauthorized access, and enhancing overall cybersecurity resilience without compromising business efficiency.

ZTA can be implemented as a phased approach. The balance between security and convenience should be one that does not prevent the efficiency of business. Key performance indicators should be created to regularly evaluate the effectiveness of the zero trust measures and adjust security policies as needed. As a threat landscape evolves, security measures should be agile enough to adapt to new challenges without sacrificing efficiency.

8. What trends are you seeing with cybersecurity insurance, and how can a business make sure they are adequately covered?

In the evolving landscape of cybersecurity insurance, current trends are emphasizing a more detailed and proactive approach to insurance questionnaires. Insurers are increasingly asking businesses specific questions to comprehensively assess their cybersecurity posture. Notably, questions regarding the inclusion of multifactor authentication (MFA), security awareness training programs, and the existence of comprehensive security policies have become prominent.

By incorporating these elements into their cybersecurity practices, businesses not only strengthen their overall security posture but also position themselves more favorably within the cybersecurity insurance landscape. The integration of MFA, security awareness training, and comprehensive security policies reflect a commitment to risk mitigation, which can result in more tailored and cost-effective insurance coverage. Additionally, organizations should stay informed about evolving insurance trends to align their cybersecurity practices with industry expectations and optimize their insurance premiums effectively.

9. What are the most essential tools that an organization should have in their technology stack if they have a limited budget?

For organizations on a limited budget, building a solid cybersecurity stack involves making strategic choices. Security awareness training is critical, educating employees to recognize and mitigate cyberthreats effectively. Endpoint detection and response tools play a crucial role in identifying and neutralizing malicious activities on devices. Additionally, incorporating a comprehensive risk assessment will help you understand your vulnerabilities, prioritize your risk for budgeting purposes, and strengthen security measures.

10. Who in the organization is responsible for cybersecurity, and what is the impact of management buy-in?

Depending on the size of the organization, the responsibility for cybersecurity primarily lies with the Chief Information Officer (CIO) and the Chief Information Security Officer (CISO). They work to identify cost-efficient controls to protect the organization from cyberthreats.

Management buy-in, especially from top leadership, is crucial for allocating resources and prioritizing cybersecurity measures effectively. However, it’s not only the CIO and CISO’s responsibility; everyone in the organization plays a role in safeguarding data. By fostering a culture of security awareness, each member contributes to the collective effort to protect the organization from potential cyber risks. Regular security awareness training should be a top priority for any organization to give their employees the best opportunity to prevent social engineering attacks.

11. Given the diverse range of threats companies face today, how do you tailor security solutions to meet specific client needs, and what role does your development team play in this customization?

Tailoring security solutions to specific client needs is crucial in addressing the diverse range of threats companies face today. One effective approach involves offering adaptable options to accommodate various client requirements. This approach includes solutions tailored for organizations without internal IT teams, providing comprehensive support. For clients with existing IT teams needing assistance, customizable options cater to specific needs without overwhelming resources.

Additionally, solutions with compliance controls are available for organizations requiring heightened security measures, with scalability ensuring these options grow seamlessly with the business partnership. This flexible and scalable approach ensures that security solutions align precisely with the unique needs and growth trajectories of each client.

12. What skills and competencies do you believe are essential for the future workforce in this field, and how do you approach training and development to foster these skills?

In envisioning the future workforce in cybersecurity, it’s crucial to recognize that much of the workforce operates in a hybrid or fully remote environment. Beyond technical competencies, the emphasis on soft skills and collaboration becomes even more pivotal in this distributed work landscape.

Essential skills for the future workforce extend beyond traditional technical expertise, underscoring the significance of effective communication, critical thinking, and collaborative abilities. These skills are paramount in a remote or hybrid work setting, where clear communication channels, adaptability, and teamwork are essential for success.

To foster these skills, organizations should adopt a comprehensive approach to training and development that considers the unique challenges of remote work, including structured training programs, hands-on experiences facilitated through virtual labs, and mentorship initiatives conducted through digital platforms. Encouraging cross-functional collaboration and virtual teamwork exercises becomes instrumental in building the necessary collaborative skills.

By prioritizing a balance between technical proficiency and soft skills, organizations can cultivate a future workforce that not only excels in cybersecurity competencies but is also adept at navigating the intricacies of a distributed work environment. This holistic approach ensures that cybersecurity professionals are well-equipped to thrive in the evolving landscape of remote and hybrid work, where effective communication, collaboration, and adaptability are key to addressing cybersecurity challenges.

13. How do you see artificial intelligence shaping the future of businesses, and what potential benefits and challenges do you anticipate?

The future of businesses, particularly in cybersecurity, is deeply influenced by artificial intelligence, offering both promising benefits and challenges.

AI plays a pivotal role in cybersecurity by automating threat detection, providing insights from extensive data analysis, and enhancing defensive measures. The potential benefits encompass heightened cybersecurity efficiency, proactive threat mitigation, and improved response mechanisms. However, challenges arise, including the ethical use of AI in cyberattacks, concerns over data privacy, and the intricate issue of copyright ramifications tied to employing AI-generated code in the software development cycle. Navigating these intricacies will be essential for businesses to harness the advantages of AI in cybersecurity while responsibly addressing potential challenges.

6.    With the rise of remote work, how are businesses adapting to this trend, and what strategies have proven successful in maintaining productivity and employee engagement?

Businesses should be strategically aligning their security practices with the demands of virtual operations. Prioritizing flexible work arrangements, organizations should be integrating more advanced cybersecurity tools to ensure secure remote communication and project management. Transparent, secure communication channels, coupled with ongoing cybersecurity training, play a pivotal role in cultivating a cyber-resilient workforce. A steadfast commitment to cybersecurity principles further reinforces a strong and interconnected remote cybersecurity culture. This proactive approach not only safeguards organizational assets but also fosters a heightened sense of security awareness and engagement among remote teams.

Your knowledge is critical to building a strong defense in the fast-evolving cybersecurity landscape. As a technology partner, we strive to empower you with the information and tools you need to help safeguard your business.

If you have any questions about cybersecurity or want to learn more about your business’s current security posture, please reach out to us. We offer cybersecurity risk assessments designed to help identify vulnerabilities and develop a robust strategy to help mitigate your risks most effectively.

Your business and technology well-being is our priority—let’s build a more secure future together.