If your most critical systems went down tomorrow because of a cyber attack, how long would it take to get running again? And when did you last test that?
Michelle Abraham, Research Vice President on IDC’s Security and Trust team, says leadership should know both answers. In a recent conversation, she explains what that takes: cybersecurity fundamentals that rarely make headlines, such as knowing what you own and who owns it, and tracking whether risk is going down.
What cybersecurity fundamentals do organizations still get wrong?
Abraham’s answer starts with what hasn’t changed. “Foundational items like asset visibility and making sure you have the data collected are as important as they always have been,” she says. Knowing what you have comes first. Identity and access controls follow: least privilege, strong authentication such as MFA, credential hygiene, and regular reviews of who has access. Then come the logs and the right detections, plus tested processes for when an incident does pop up.
She notes these topics get less airtime than newer technology, and she doubts that a tool for every threat category makes an organization secure.
Does buying more security tools make an organization safer?
Not on its own. “More tools can just mean more noise,” Abraham says. If a team can’t act on the alerts from the tools it already has, another one adds to the pile. Fragmentation adds complexity, and “complexity can be the enemy of security.” Each tool tends to see only part of the attack surface, so the data has to be connected or attackers will find the gaps between tools.
Abraham ranks backup and recovery systems above most detection tools. Before the next purchase, ask what your team can’t act on today.
How should leaders measure whether security is improving?
If tools don’t show whether security is working, something else has to. Reports that count scans run or issues found measure effort. Counting activity, in her words, “just tells you how busy your security team is, but not whether you are any harder for attackers to breach.” She adds that a count doesn’t say whether critical issues were fixed or how long they sat open.
Her alternative starts with the business: which threats matter most, how much risk the organization will accept, and whether current risk sits within that level. Useful measures include how complete your asset inventory is and how much of it controls like MFA and endpoint protection cover. Third parties belong on the list: she sees organizations attacked through vendor systems, including data warehouse and backup systems. The goal is “looking at the trends more than the counts,” with risk moving down over time.
Why do security fixes stall between teams?
In the handoffs, Abraham says. Discovery tools can count the same asset more than once, so teams need a way to deduplicate. The bigger sticking point is ownership. When a vulnerable asset turns up, the security team usually isn’t the one who fixes it. One person may own the asset and someone else the application running on it. Without a clear record, the issue ping-pongs around and the fix waits. Automated asset tagging helps, along with ownership information that matches across every system.
Prioritization matters here too. A lower-severity issue that is reachable, sits on a critical asset, and is being exploited should move to the front of the queue. A high CVSS score can send a team after an exposure that doesn’t matter in its environment. Even a well-ranked list stalls, though, if the people who own the fix don’t treat it as their job.
How do you get the whole organization to own security?
The people who fix a problem often sit outside the security team, so Abraham recommends making the work easy for them. Give fixing teams a ranked list of validated exposures, with patch information or recommended mitigations attached so nobody starts from scratch. Set deadlines by asset criticality, such as three days for one class of asset and a week or two for another, and define an exception process. “If the remediation process isn’t tracked, oftentimes it doesn’t happen.”
Then make risk visible by department in front of the management team. Organizations have told her this creates enough competition that departments want to look better in the dashboards. She has also heard of it applied to asset tagging: who has the most assets with complete tags.
What one question should every leader ask?
Abraham leaves leaders with one question to ask their security teams:
“
If our most critical systems went down tomorrow due to a cyber attack, how long is it going to be till we’re operating again?
Compare the answer with how long the business can survive without that system. A mismatch puts decisions in leadership’s hands: a change to process or IT architecture, or more funding.
Abraham also urges testing, and mapping the dependencies between systems. If your identity system is down, you may not be able to bring up the others. Start there: find out what has to be running before anything else can.
