Test, plan, and test some more
In sum, as Antani noted, don’t trust, just verify with respect to tools. Chaim Mazal, chief security officer at Gigamon, notes that focusing on achieving zero trust won’t be enough. One must go beyond the recommendations being proffered by CISA and others.
“Traditional certifications don’t prove cyber resilience,” Hadley says. “To gauge true preparedness for the next attack, CISOs can put their teams through simulations and real-life scenarios.” CISOs can also identify where their team’s strengths and weaknesses exist, which is the point Benton was making when he noted that when it came time to perform, an organization must be ready to adjust.
As one who has worked within many a high-stress environment, all of which included a myriad of different personality types with different levels of experience and education in their background, one really doesn’t know how the team is going to function until the day of reckoning arrives and the rubber hits the road. Testing and more testing is how the team stays between white lines and on the road to success.
Ensure deep observability across your organization
“Cybersecurity leaders are being fed a range of recommendations and guidelines for architecting a zero-trust framework,” Mazal says. “My recommendation to them is to make sure they have deep observability across their organization’s hybrid cloud infrastructure. This will address hybrid cloud security requirements beyond zero trust. Strengthening the capabilities of log-based security tools with real-time, network-derived intelligence and insights will enable them to detect previously unseen threats and better secure their hybrid cloud infrastructure.”
For CISOs to continue to have their voice heard, verification is a must and achievable, but not without steadfast effort. If either technology or personnel are found lacking, the gaps in either technology or personnel will be exacerbated, and things will go south in a hurry.
Therefore, test, and test often, both your personnel and the tools they use to do the job. As Mazal says, “taking a zero-trust approach to workforce cyber resilience and backing it up with regular exercise, proof, and measurable improvement will ultimately lead to stronger cyber postures for organizations, which should be a bottom-line priority for boards and business leaders alike.”
