WELCOME TO THE JUNE 2024 NEWSLETTER

Cyber Scoop is KeyStone Solutions monthly newsletter about the latest trends, topics, and articles relating to cybersecurity. As a Managed Service Security Provider (MSSP), KeyStone’s expert team helps small to medium sized businesses with IT services including virtual Chief Information Security Officer (vCISO), cybersecurity, help desk support, Governance, Risk, and Compliance (GRC), cloud solutions, and KeyStone’s signature service, IT Team as a Service (ITTaaS) which is an all-encompass solution.

From The Desk of the CISO

Does A Small Business Need A Cybersecurity Program?

By Rob Ashcraft, CISO at KeyStone Solutions

I meet with many small businesses who are concerned with the strength of their cyber defenses yet are not convinced they need a comprehensive cybersecurity program. Most are not sure what is involved, how difficult it would be to develop and implement, and especially how it would impact their operations. I would like to take a few minutes to provide some insights on what a cybersecurity program is and the benefits that come from having one. A cybersecurity program starts with a defined cyber strategy to protect your business, employee, and customer data from the evolving cybersecurity threats. The cyber strategy is based on documented policies, controls and processes that are carried out over a timeline and address cyber threats against every aspect of your business. A solid cybersecurity program also includes a comprehensive set of security policies and documented plans for asset management, data management, access control, risk management, vulnerability management, third-party risk management, physical security, incident response, disaster recovery, and business continuity.

IT Security Policy Importance, Best Practices, & Top Benefits

Commentary by KeyStone’s Rob Ashcraft

An article by eSecurity Planet provides a simple, yet concise breakdown addressing the importance of IT security policy for any size organization. The U.S. National Institute of Standards and Technology (NIST) states, “Information security policy is defined as an aggregate of directives, regulations, rules, and practices that prescribes how an organization manages, protects, and distributes information.”  I often describe IT security policy as the foundation document of a cybersecurity program, outlining security controls, standards, acceptable use, and defining an organization’s digital risk management and attack surface.

This article is chocked full of good information. Here are my key takeaways:

• The ultimate goal of an IT security policy is to provide a formalized set of rules and policies to benchmark the IT and cybersecurity posture of an organization.
• Security-minded organizations understand the importance and benefits of IT security policy and consider it a basic requirement to start down the path to security maturity.
• Regulators often cite a lack of formal policies as negligence as well as cause for higher fines and punishments after a breach.
• Written policies naturally generate evidence of compliance and show a formal security strategy has been approved by corporate management and implemented.
• In the event of a breach or successful cybersecurity attack, government agencies or stakeholders may pursue legal action. Legal standards generally only require “reasonable efforts,” which can be supported with the documentation from an effective security policy and the reports that demonstrate the policies have been implemented.
• Documented IT security policy enables key cyber objectives that will have a daily impact on the organization by implementing a cyber strategy, goals, managing user behavior, and measuring success.

Click on the link below to read the article from eSecurity Planet.

View Live Cyber Threat Map From Check Point