Magazine menu Close Magazine menu

Author

Nick Drage

Nick Drage is a cybersecurity consultant, helping customers make informed decisions about products and services, and their overall cybersecurity strategy. Nick is interested in how individuals and organisations find, test and create winning strategies in any field, from cybersecurity to American football or Tetris.

Get in touch with Nick

Latest stories by Nick

successful collaborative working

What 20 years of remote collaborating has taught me

  • Remote working
  • min read
    • The future of work is partly or fully remote, especially for tech-led professions. According to McKinsey and Company, more than half of employees want more flexibility from their employers and want to work remotely more than from the office. The pace of attitude change has been fast, even if your usual way of working stayed the same. Effective collaboration is an ongoing challenge for many remote teams. Businesses of all sizes have been known to reach for the next new collaborative tool on the shelf, expecting it to bring minds together for a lightbulb moment continually. Thinking back over my career in cybersecurity, I believe it's not the tools that make or break collaboration. But I have a few ideas on what the critical cruxes of collaboration might be. Let your empathy drive how you work I first worked with others remotely at the beginning of the 2000s. The tech was basic back then: A mobile phone, laptop and dial-up internet. I was giving on-call technical support for an internet service provider's security team. Waking up in the middle of the night to giving out-of-hours support was an abrupt introduction to working with others online. Most people would wake me and launch into a description of an incident ticket, immediately asking questions while I juggled my mobile phone, laptop and coffee cup. But there was one person who'd thought about the person on the other end of the phone. They would call to wake me up, say they'd ring back in five minutes and hang up. It meant I was set up and awake when we started working on the problem together. It made a big difference to my ability to think about an issue in the right frame of mind and not make it worse by being half asleep. Shift the barriers to deep focus For over a decade, I worked as a penetration tester in different teams and companies, either onsite or remotely. I would mimic a cybercriminal and try to compromise a software implementation or do general technical audits, aiming to find as many issues as possible. Often this would be as part of a team. Some organizations I worked for insisted everyone work from the same location, while for others, everyone worked remotely. Penetration testing benefits from seeing someone else's screen and easily sharing ideas around a group. A chance comment by a colleague might give you a clue on your target. But it also benefits from long periods of concentration, learning on the fly and going down rabbit holes without being asked what you're doing. I usually preferred the work-from-home teams. It was easier to talk to a colleague over the phone and email screenshots remotely than to focus intently in a busy office. But for others, having team members close at hand and the feelings of camaraderie were most important. Wherever your team is and what type of people make it up, management must play a crucial role in making sure everyone has a chance for deep focus. University of California's Professor Gloria Mark is one academic asking the price of an interruption. Her paper, The cost of interrupted work: More speed and stress, concludes that distracting someone from their work doesn't slow them down, but means they produce poorer quality work and feel more frustration and stress. Use face-to-face time for what it's best for My last full-time job showed me how the remote work approach is more important than tools or factors like how often staff meet. I was giving technical expertise for cybersecurity product sales. Our collaboration tools weren't great. There was the usual nightmare of email and calendar software, partly integrated with more software for phone calls and text chat. Collaboration was mainly over conference call rather than video. I usually worked remotely, but some of the team used offices shared with colleagues or the wider company full- or part-time (known as hybrid working.) Management also drove the team feeling by continually staying in touch and freely giving both praise and suggested improvements. Physical meetings were infrequent but scheduled. They were both practical and social, giving a chance to get to know colleagues outside text or phone interactions. Colleagues and associated teams made the most of face-to-face meetings. The sales team always made sure they spent time together before and after visits to customers and potential customers. Consider team skill mix and have a driving purpose Recently, I worked with a small team to organize the first game-based cybersecurity conference, Play Secure. It was hard establishing a new conference around a novel theme. And with the conference being entirely online, we needed to ensure it didn't feel like just another set of webinars. For fully remote working with a new team, it went especially well. I think the team's success secret was the right combination of interpersonal skills and a shared sense of mission. We didn't get so burnt out through increased online interaction and were motivated enough by purpose to overcome the limitations of the tools. Use your tools on a strong foundation Lockdowns led to my becoming a fully remote worker, which fits the needs of my customers spread across different time zones. My work is usually intensive with short periods of decision support for customers, then intervals for research and consideration. Projects can have different delivery speeds. You need to adapt to others' work demands and availability and establish rapport over a simple video call. In this case, I think tools make a difference. It's hard to find a positive aspect to the pandemic, but the mass adoption of video conferencing has helped my work. It lets me give timely advice to customers without being limited by travel time and cost. When deciding to go remote-first If you or your team want to go remote-first, think through what has worked for you and what hasn't. Take staff preferences into account. Meeting in person once a week, once a month, or once a quarter can greatly affect team wellbeing and cohesion. It's easier for a distributed team to come together than for an in-office team to work apart and avoid interruptions successfully. With the savings on the costs of office space and time spent commuting, opportunities abound for thoughtful organizations to enjoy the benefits of remote work by forging their own 'new normal.'
business reputation data breach

How to strengthen your IT security operations after a data breach

  • Business
  • min read
    • The aftermath of a data breach can be measured in many ways, depending on who you are. For those outside the organization, the public perception that an organization has been compromised, known as reputational damage, is often quoted as the most significant long-term aspect of a data breach. To measure the effect of a breach on a company's health, Comparitech analyzed the long-term impact on the share prices of breached companies. This research is nuanced and worth reading in full, but one of the headlines from the September 2019 edition is telling: after about a month, share prices rebound and catch up, on average, to NASDAQ performance. And most importantly, the companies keep operating. The companies in the analysis include many brands we continue to use every day in our digital lives: Yahoo!, eBay, LinkedIn and Facebook. So what's the real cost of a data breach? According to research by Adrian Sanabria, a well-regarded former senior analyst in the information security community, there are a relatively small number of companies that are hacked out of existence. Examples of severe consequences for companies of all sizes are few and far between. So for the board, it's easy to under-estimate the impact of a breach by looking at share price or sales targets alone. However, the real impact and costs from loss of continuity go much further. For Kaspersky's Global Corporate IT Security Risks Survey, organizations of all sizes across the globe were asked about the broader costs they have to deal with when recovering from attacks. For enterprises, it's now, on average, a cool $1.4M to clean up a data breach. Beyond the financials, if you want your decision-makers to see all the consequences of a compromise, there are other factors to review. These are harder to define in absolute numbers, but they all affect the company's performance and reputation. Keep these points in mind when assessing risk or advocating for an additional budget for defense. Internal reputation damage The internal reputation of the security team can be hit hard. Regardless of the actual cause, they can be seen as responsible. This has even more risks to the long-term success of the team: Loss of continuity A CISO (Chief Information Security Officer) is often expected to resign after a significant breach; they carry the can as their position is viewed as taking responsibility for the failure. I would argue the removal of a single leader as a way to solve often systemic and complex problems is a strategy only good for Hollywood villains. Next time you're at the cinema, notice how successful their organizations are by the end of the movie. Scapegoating your CISO is an unwise strategy. It will take months, or even years, for the new CISO to be hired then acquire the knowledge of their predecessor, the established relationships, ways of working, and so on. The new CISO, as with any incoming C-suite leader, tend to make changes to make their mark, which can cause further disruptions in continuity and additional strains on the InfoSec team. Low morale Morale is tricky to measure and account for, but from the conversations I have with members of the InfoSec community, your IT staff can be despondent after a breach, particularly the security team. This may be in part due to the implication that their efforts didn't protect the company, and in part, due to burnout from the increased efforts to recover after a breach. The negative effect on Equifax staff is a particularly good example. Individuals were criticized in social media and even received death threats, and without appropriate support from the organization to safeguard team member's reputations and mental health. Increased auditor scrutiny For both your internal audit teams and the third party auditors you bring in, they will all increase their efforts to ensure they're not seen as missing something, and therefore being the party to blame for any future compromise. That sampling approach you used before that saved hours of unnecessary analysis? That won't be allowed anymore. More internal bureaucracy Organizations often respond to a breach by imposing new requirements on all staff, rather than by making the existing requirements easier to understand and follow. This may increase your employees' chances of understanding and following instructions or their willingness to bypass them to get their job done, which, in turn, could increase your organization's exposure to risk. So what should you do differently? With all these potential consequences and risks, here are some tactics you could try to have a happier ending after a breach. Keep your CISO Unless the incident can be directly attributed to an irreversible failure on the part of the CISO, don't fire them to appease customers or shareholders or any other aggrieved group holding a short-term view. Your CISO will have the experience and knowledge you need to see you through this issue. According to Kaspersky's 2019 survey based on more than 20 personal interviews with CISOs, unless the incident was directly their fault, the majority felt their employer would support them. Invest in building a cyber-aware culture Strengthen cyber-awareness training for all employees. This can help your employees work together more effectively in the face of a common enemy (cybercriminals), and appreciate the difficulties the security team faces keeping the organization safe. Plan your breach recovery strategy The best time to prepare for your recovery from a breach is before it happens. Take one step today, maybe start to look at how your organization would detect a breach, or how you can test the detection capabilities you have. Re-examine your existing strategies. For example, Kaspersky's IT Security Economics report highlights the benefits of having a DPO (Data Protection Officer) and SOC (Security Operations Center) in reducing the financial impact of an incident. When estimating impact, at any point before or after an incident, make sure you and your stakeholders appreciate these factors and consider them alongside the financial assessment. Ensure everyone has all the facts, not just those that are easiest to quantify. Any organization today has to "assume breach," from the smallest company keeping an offline backup away from the office to the largest enterprise looking to implement an advanced defense solution stack, which includes EDR (endpoint detection and response) and an anti-targeted attack solution. But a side effect of this wise approach can be an undue pessimism about the effect of being compromised. By giving your CISO confidence to make longterm plans because they'll survive short term problems, by improving the security awareness within your organization and by preparing in advance, you can make it through a compromise relatively unscathed. With a more planned and supportive approach to safeguarding the reputation and strengthening the performance of your InfoSec team, you will build a more secure and resilient organization in the long run. This article was published in Jan, 2020.
cybersecurity purchasing strategy

Avoid costly firefighting: how to be smarter about cybersecurity procurement

  • Cybersecurity
  • min read
    • Impulse buying IT solutions feels like you've achieved something today, but have you just given yourself an integration headache for tomorrow? With a more planned approach, you can get more from your budget and protect your resources more effectively. Here are two questions to ask yourself: For most organizations, their approach is to try to understand the vendor landscape and then understand the breadth and complexity of their IT security problems. To an extent, this strategy can work. If you buy the best products you can find according to the budget you have, then you're working towards having the optimal security posture for your organization. But the vendor landscape today is so concentrated that you can spend all of your time just trying to understand all of the products you could use, then choosing between them. Keeping an eye on Sounil Yu's Cyber Defense Matrix helps you deal with this. As you read this, I expect your risk register is top of mind, right alongside the most recent data breach you've just heard about. So it can feel right to get on and do something rather than stop, think and consider alternative courses of action. By taking action, for example, buying a product, you think the problem's fixed, giving you one less thing to think about. The problem?  This 'strategy' doesn't work. But why? Firstly, it doesn't support an organizational policy. It's just what you did before, and so it's what you continue to do. Easy win. This approach prevails without proper reflection, and no one can question the decision because it's never clearly expressed in a way that permits it to be challenged. Secondly, your company ends up with a mix of disconnected solutions that are installed but not configured, and sometimes their monitoring capabilities and logs, which looked so impressive during the sales presentation, and only considered after a suspected breach. However, with some small changes, the buying approach can pay off, or at least reduce the effort you spend firefighting down to a manageable level, so you have breathing space to focus on new projects. Here are three ways you can get smarter about buying the right cybersecurity solutions for your business. 1. Have a buying strategy for attending events Firstly, use the conferences and exhibitions you attend intelligently. InfoSec conferences, especially those dominated by a vendor hall rather than by tracks of presentations, can be beneficial if used in the right direction. It can be tempting to use the occasion to catch up with contacts in the industry, put in an order for a new solution to justify the time and money it took to attend and then go home. But you can be smarter than that. Don't be afraid to play off vendors against each other. Shuttle between them comparing advantages, answers and prices, examining any criticisms raised by one vendor with the responses of another. Ask someone who has left a booth you've been at, or are considering visiting, what they thought of a solution and its vendor, and if there are any aspects they found particularly useful or troubling. It's a good way to think through your current position, with a side benefit to make the most of networking opportunities without the shallow performance of pushing your business card (or scanning your pass at more technologically advanced events.) 2. Try before you buy Secondly, consider either a bake-off or a trial period or a pilot project – whichever is your organization's preferred way of working. A bake-off is similar to the televised cooking competitions; each of the products under consideration is put in direct competition with the others to see which offers you the best solution for the least code. The options you select, of course, depend on the structure of your estate and many other factors about your organization, but in a rush to resolve an issue, you can instead spend a few weeks testing your implementation, and so saving yourself time in the long run. In particular, either a bake-off or a pilot project shows that the products are under serious consideration, and your vendors should be able to devote resources to making the test period a success and resolve any technical issues before a full rollout. I recommend sequential pilot projects over bake-offs, only progressing to the next pilot project if the previous one didn't give you the results you wanted. A pilot project is far less intensive than the effort required for a bake-off and dealing with multiple vendors simultaneously. Also, it's much easier to have set aims for a pilot project, making it an easy purchasing decision at the end of the trial period, while keeping everyone focussed during the exercise. 3. Take a lesson from the world of gaming Finally, consider "table-topping" or "wargaming" the introduction of the technical solution. This is like running a pilot project, but conceptually. By "wargame," I mean a business wargame. It's called a "tabletop" because that's where you run the game, and that's specifically where everyone concentrates their attention. You can either buy an appropriate game, hire a consultant to build one, or design one yourself. The process is more straightforward than you think. To put a simple wargame together, you need some kind of board to represent the situation you're discussing (for example, a network diagram), some pieces or markers to represent different resources (like some coins to represent the available budget) and a brief set of rules to determine how the game progresses. This prevents decisions being made according to the opinion of the most senior person present. Unfortunately, the word "game" has all kinds of unhelpful connotations, making the exercise not seem serious enough for the gravity of the decision you're making, but the game and its rules are there to help you think and to encourage everyone to contribute. Meetings are a poor format for decision-making, with the quality of the decision usually determined by how long the meeting was, who shouted the loudest and how close it was to lunch. By running a tabletop exercise playing through the implementation of a project, you can get everyone around the table to consider the impact of the new technology in their field. Does a more efficient endpoint threat management solution send too many alerts to the over-worked Security Operations Center? Does the new firewall implementation work with existing configuration maintenance software?  From there, scenario plan a typical day or week and judge the impact on your staff and those departments who you work with on taking on the new solution. Don't be afraid to modify the format of the game as it progresses, to use counters or markers on a board to represent the impact of network changes or the demands on staff. A simplistic representation of your proposed solution can quickly reveal unrealistic demands or requirements that never come out in discussions or a spreadsheet-based analysis. As a side benefit, getting people together to think through a procurement decision and its ramifications in this structured way can have serendipitous benefits, as different silos within your organization form stronger links, improving decision making in the future. Overall, buying the best solutions you come across can get you through the next quarter, especially if you combine it with the occasional heroic effort by your employees when inevitable problems occur. But that kind of strategy isn't sustainable, and it isn't the optimum use of your resources. Your attackers are becoming smarter, but your budgets aren't getting bigger, so you're going to have to out-think your opponents. By planning more strategically before buying, you can make the most of your IT security budget. The opinions in this article represent those of the author.
non technical ciso header

The accidental CISO: How to lead tech teams without a tech background

  • Cybersecurity
  • min read
    • The role of the CISO, the Chief Information Security Officer, has traditionally been a technical one. With organizations taking a technology-first approach to secure their infrastructure and data, it seemed natural to elevate technical members of staff into the role to make the best use of their knowledge. But not everyone in this role is a hands-on technical security expert. What do you do if you don't have a technical background and you're a CISO (or the equivalent level of task responsibility) and people expect you to understand all of their technical security problems and issues? You'll most likely be encumbered with many non-technical requirements: personnel management of direct and indirect reports, all of the admin that goes with a senior position, being able to understand the new language those around you are using or the concepts they're referring to, translating between technical and non-technical staff, understanding and prioritizing business outcomes over purely technical or security-related results, threat modelling issues around compliance and liability and litigation… all of this… while trying to learn the technical knowledge at the same time. Or even if you were in a technical position before, you're expected to maintain up-to-date knowledge in an ever-changing field, while learning all the new skills required for your management role. Thankfully, many organizations now realize how important mental health concerns are for their people, particularly senior staff, where impaired decision making or forced absence from work can have a detrimental effect on the business. But while trying to stay balanced, you still have a problem to solve: how do you stay up to date with technical developments when you're not in a technical position? Here are a few solutions to consider, depending on the situation you're in. Talk to your staff openly When you're the most senior person within a particular discipline in your organization, it can feel that you need to be the most knowledgeable and most incisive. But that attitude is more suited to bosses in video games and Hollywood villains than to a corporate hierarchy today. Talk to your staff. Find the experts and ask them for their opinion, or ask them to brief you on the latest developments in the field. Not only are they saving you considerable time and effort, but this common ground where you're asking for advice helps build a much better relationship with your team. Being a source of knowledge to you is part of their duties, and if you honor this task with that level of importance then they will too. Of course, you need to be aware of any local considerations and biases, for example, a technical expert in data loss prevention (DLP) is unlikely to advocate the abandonment of this technology for a different platform, but with this context in mind, you can access decades of their accumulated knowledge in a few hours. Build good relationships with your vendors Image credit: Getty Images Find a good vendor, ideally, a good systems integrator (SI). They usually have a poor reputation in the industry, but it's unfairly so. However with this being a technology-led field, you're going to have to refer to experts, and who better than organizations that sell multiple types of solutions. Find a good SI. Ensure they're aware of your budgets and constraints; also that they know you're looking to build a relationship rather than make a quick purchase. As there's a greater upside for them than an immediate sale, your chosen SI should see you as a long-term relationship, and as your organization grows, so will your budget to spend with them. Subpar salespeople think in the short term to make a quick sale today. Better salespeople realize the pressure you're under and know how valuable they can be to you if they're trustworthy and offer high-quality advice – and, in return, if you go straight to them for your next purchase, they've just saved a considerable amount of sales effort. Befriend the technical staff at your vendors My opinion of salespeople is built around those I've worked with, so it might be more favorable than yours. Maybe the vendors you deal with simply aren't that trustworthy, or you don't have the budget to attract any of the SIs. In that case, focus on the technical staff at your vendor, the pre-sales support who accompanies the salesperson. This technical person will either be a dedicated pre-sales resource or a developer or architect for smaller vendors. It's unlikely they'll be on commission and evaluated on sales performances, so they won't be financially influenced to deceive you. It's also quite likely that they're blunter, technically minded and a bit of a problem solver – they'll see your situation as a puzzle to be solved rather than a business opportunity to be exploited. And if their current employer's product doesn't fit, then they're more likely to explain why. In particular, keep this in mind at conferences. See if you can catch the technical sales support person away from their stand or after a talk to get an honest opinion of their solution. Alternatively, at either a conference or a sales meeting, see it as your job is to discuss the financials with the sales rep and protect the technical person you've brought along with you; that way your technical team member can talk, unhindered, to the technician from the vendor. While you're soaking up the infographics and sales numbers, your technical person can get a more honest view and report back to you afterward. How to avoid bluff or burnout It's common for security leaders to pick one of two approaches: Bluff – especially for non-technical or formerly technical leaders, it's easy to try and bluff your way through decisions, to give confident guesses, expecting your team to make the best out of what you've decided. You might get lucky for a while, but bravado alone can lead to staff taking you out of the decision-making loop to avoid your mistakes. Burnout – try to take on all the new business skills while maintaining your existing specialist skills, to be the leader everyone expects you to be. This approach isn't sustainable. The strategies I've proposed are more difficult as they need more investment and commitment, but it's a better way forward in the long term that will lead you to make more effective technology decisions in the future. The opinions in this article reflect those of the author.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries