Staying up on the cybersecurity trends and the things CISOs and IT security practitioners need to know for optimal protection
Six years ago, I knew very little about the world of cybersecurity, especially the current cybersecurity trends, the unique needs of CISOs and practitioners, the limitations of busy security teams, the strengths and limitations of various cybersecurity solutions, and what the best cybersecurity practices are for the best possible ROI/result. Now, to be honest, I fancy myself pretty savvy on the subject – and, more especially, where to source the latest news and insights.
True strength lies in understanding, and it’s never been more important for security leaders – indeed, anyone with an eye into an organization’s cybersecurity defense, from practitioners to the overall c-Suite – to understand the latest trends, risks, and solutions, and to properly understand the distinct requirements, assets, and susceptibilities of their organization.
Understanding tends to fall into three areas:
- Staying current with emerging cybersecurity trends, threats, and industry advancement.
- Knowing an enterprise’s distinct requirements, strengths, and potential cybersecurity weak points.
- Being familiar with the diverse array of cybersecurity options, their prospective advantages, and where they fit in relation to your business and the future of cybersecurity.
As a cybersecurity writer and content creator, be it with a genuine interest in the topic (as my repeated cheeky posts on the topic of Linux cybersecurity will no-doubt testify), and here’s how I do this easily and with the minimum friction.
Staying Current with Cybersecurity Trends
It’s critical to keep abreast of the latest trends, threats, and solutions in the cybersecurity world. Here are a few suggestions, including a few links, that I use as a cybersecurity writer to stay up-to-date:
- Cybersecurity Podcasts: Podcasts are great time-conscious solutions for learning. People ask me why I don’t mind driving for an hour or more. It’s because I tune into the podcasts like Security Now, The CyberWire, and the slightly terrifying Darknet Diaries, and learn something while I’m between places.
- Subscriptions to Cybersecurity Publications: I subscribe to some of the more reputable cybersecurity magazines, journals, blogs, and newsletters. Some of my favorites include Krebs on Security, DarkReading, Beeping Computer, The Register, and The Hacker News.
- Webinars and Online Courses: It pays to take part in the occasional webinar and online courses, as offered by institutions like Coursera, and Udemy, or by assorted cybersecurity vendors like ourselves.
- Security Conferences: Attend cybersecurity conferences like RSA, DEFCON, and Black Hat (come say hi, we’ll be there in Las Vegas, Aug 9th to 10th, booth 2819). I was at Infosec Europe a few weeks ago, to walk the floor and talk to fellow cybersecurity “journalists” and our sales team and partners, to get a feel of what people care about and the new industry concerns. It was very illuminating.
- Follow Experts on Social Media: Keep tabs on thought leaders and influencers in cybersecurity on LinkedIn, Twitter (or possibly now Threads/Bluesky), and other social platforms. This might include the likes of Brian Krebs, Rachel Tobac, Dave Kennedy, Chris Krebs, Graham Cluley, our own Sameer Malhotra, Katie Moussouris and Eugene Kaspersky.
- Vendor Blogs and Updates: Follow the blogs and updates of cybersecurity product vendors for their latest advancements and solutions. Not all are created equal here. Admittedly, many use their blogs for advertising purposes – but if you look around, it’s possible to find blogs (like ours) that want to share advice-based and thought-leadership content. More on the side of the CISO than the side of the marketing dept.
- Cybersecurity Newsletters: Subscribe to newsletters from organizations like SANS Institute or Cybersecurity and Infrastructure Security Agency (CISA). The trick with newsletters, however, is finding time to read them. Personally, I use the Speechify Chrome plugin for this – turning them into podcasts read by Snoop Dogg.
- Online Security Communities: Join online cybersecurity forums and communities such as Stack Exchange, GitHub, and Reddit’s r/cybersecurity.
- Certification and Training Programs: It’s possible to enroll in certification and training programs like CISSP, CISA, and CompTIA Security+, which offer a wealth of info and insights. I’m a big fan of Hack the Box.
- Government and Regulatory Updates: Follow the regulatory bodies for cybersecurity rules and standards updates, plus the latest red alerts and vulnerabilities.
Know Your Local Environment
Looking closer to home, as the chief protectors of an organization’s digital infrastructure, it’s essential for CISOs to totally know their organization’s specific cybersecurity requirements, inside out – strengths, and weak points. This understanding is the basics of developing any tailored cybersecurity strategy and is the only way to address the unique risks inherent to their organization’s operations and make informed and educated decisions.
Acknowledging strengths allows for their further capitalization, boosting the cybersecurity framework where it’s strongest. Recognizing vulnerabilities presents opportunities for fortification, minimizing potential attack vectors. The grasp of these unique variables directly influences the effectiveness of cybersecurity measures, and the purchase of possible solutions, contributing to the resilience of the organization against hostile cybersecurity trends. Try investigating some of these:
- Risk Assessment: Conducting a comprehensive cybersecurity risk assessment helps identify the organization’s unique security requirements and potential vulnerabilities. It involves analyzing the company’s digital assets, systems, and data, and assessing their value and vulnerability to various threats.
- Security Audits: Regular security audits help measure the effectiveness of the current cybersecurity controls and identify areas that need improvement.
- Business Alignment: Understanding the business objectives, operations, and processes can help identify the organization’s cybersecurity needs. This includes understanding the data flow, key digital assets, and how these elements relate to the overall business objectives.
- Penetration Testing: Regular penetration testing by internal teams or third-party security firms can help identify weaknesses in the organization’s defenses.
- Threat Intelligence: Utilizing threat intelligence helps understand the evolving threat landscape and prepares the organization to deal with potential threats proactively.
- Industry Standards and Compliance Requirements: Familiarizing oneself with relevant industry standards and compliance requirements can provide insights into the baseline security requirements that the organization should meet.
- Input from IT and Business Teams: Regular communication with the IT department, development, and other business teams can provide insights into the organization’s unique cybersecurity strengths and weaknesses from different perspectives. Drop in on their stand-ups occasionally, and ask how security can help dev.
- Incident Response Analysis: Evaluating past incidents, breaches, or near-misses can provide crucial learnings about the organization’s vulnerabilities and the effectiveness of its response mechanisms.
By taking these steps, a CISO can gain a deep understanding of an organization’s unique cybersecurity needs, strengths, and weaknesses, and build a more effective, tailored cybersecurity strategy.
Knowing the Cybersecurity Options and Their Benefits
There are A LOT of solutions out there, providing a variety of services and with a multitude of features. No one is expected to stay abreast of them all, but when building a multi-layered stack, there are particular standouts that will be important to some businesses and not so much to others. If you are looking to plug a specific vulnerability, ask. Start with the chat function or their website, and get more in-depth by asking for a demo. Looking at reviews is always useful, but look for consistency and not just mainstream awards – though awards are nice, and we love getting them. Asking for usage cases is tricky in cybersecurity, as clients are understandably reluctant to comment on matters of corporate safety and business readiness, so less of an indicator than most industries. If they are available, they are very often anonymized to protect the organizations involved.
Our (TrueFort’s) primary solution is complete lateral-movement protection, for the network or in the cloud, with best-in-class microsegmentation, application-centric security, and comprehensive behavioral profiling. We can’t comment for everyone, obviously, but we’re told that many organizations also come to us for our unique ability to integrate with existing EDR agents, like Crowdstike and SentinalOne, our IT/OT/IoT protection partnership with Armis, our ease of use and swift deployment time, and they renew with us for our stand-out customer service/technical support. Clients tell us they conduct extensive investigations to find these qualities and that there’s no substitute for being able to ask direct questions.
We’re here to help. If you’d like to know more, please ask, and we recommend you do the same for any other solutions once you know your protection goals, the general (and your industries) threat landscape, what the future might hold, how your organization already stands, and your specific business cybersecurity needs.
