As institutions of higher education reel from recent cyberattacks in the United Kingdom, IT departments work tirelessly to secure sensitive student data. Student records offer a wealth of personally identifiable information (PII) from birth dates and social security numbers to bank account numbers and home addresses. In parallel, a study released by EDUCAUSE in July 2020 notes that the CIO’s Commitment on Diversity, Equity, and Inclusion (DEI) reports that 83.1% of respondents strongly agree that “diverse, equitable, and inclusive workplace environments foster more effective and creative teams of technology professionals.” Although at first glance, these two issues appear unrelated, bringing diverse voices to the cybersecurity table may provide a way through, rather than around, the current security struggles facing remote learning models in higher education. 

The following outlines three steps the C-suite and other executive team members should take to prevent and survive a data breach. But first, it’s imperative all involved heed this initial piece of advice when planning cybersecurity; treat breaches not as a possibility, but as something that is going to happen.

The need for improved security for remote workers requires more resources; however, the ongoing economic conditions often require lowering costs. A Microsoft survey found most leaders increased budgets for security and compliance (58 and 65% noting an increase), while 81% of respondents also reported pressure to lower security costs overall. IT is therefore tasked with protecting their company’s networks from the remote work-related threats while operating with leaner budgets. Doing this effectively will require multiple strategies to make sure your network is secure with the shift to remote work. Here are three examples on how broader security can be achieved.

Building security and privacy into product development is more critical today than ever before. First introduced through the Microsoft Trustworthy Computing initiative in the early 2000s, the well-known security development lifecycle (SDL) is a framework designed to do just that. It was originally devised to enhance software security, but an SDL process can and should be applied to all types of products to help root out security and privacy vulnerabilities, while establishing long-term resilience in the rapidly evolving threat landscape.

Social engineering is a term that refers to efforts by hackers and cybercriminals to use people — rather than technology — to gain access to sensitive systems and information. It’s a problem that information security experts have been wrestling with for years and one that, in the midst of COVID-19, has become both more prevalent and more challenging.

Building a cyber-resilient enterprise informed by threat intelligence is not an easy task. Risks and requirements are often as unique and diverse as organizations themselves. Determining factors like industry, size, and market contribute to one simple truth: a one-size-fits-all approach to incorporating threat intelligence does not exist. Some invariants, however, do remain; successful threat intelligence programs must staff the right people in the right positions. Below, I’ll introduce four core threat intelligence focuses to consider as businesses plan and allocate budgets for 2021:

Securing identities and their privileges and access should be at the center of your strategy for reducing your cloud attack surface. The old network perimeter, with its limited number of points of ingress secured with firewalls and other perimeter defenses has given way to a distributed arrangement. Software-as-a-Service (SaaS) today is the new IT, and cloud identities are the new perimeter with thousands of users and points of potential failure existing outside of your traditional security protocols. The greatest threats to this new perimeter include:

The cyber intent strategy is to seek out the reconnaissance traffic that precedes an attack and manipulate it so well that the attack never succeeds. Leveraging and countering malicious cyber intent as your earliest defense draws from information warfare. Investing a small misdirection here could pay dividends later.

The role of the chief information security officer – or CISO for short – is to understand a corporation’s cyber threat landscape and know where vulnerabilities lie. And given the relentless increase in sophisticated hacking, their clout and importance to the CEO and Board is increasing exponentially.