How should IT Managers approach Cyber Security?

The response I usually hear to this question is “They should work with the CISO or the IT Security Manager to ensure the appropriate controls are in place.  

What’s usually overlooked is that 99.2% of UK businesses have fewer than 49 employees. 0.7% have between 50-250 employees and 0.1% have more than 250. For most UK businesses the IT Manager is the CISO, the infrastructure engineer, the out-of-hours support and many other things. They’re the allrounder, expected to know how to fix anything that plugs in, make strategic decisions, negotiate contracts, manage budgets and lead support teams, but what do they know about cyber security? 

Cyber Security and IT are separate things 

This is a common view among those outside the industry. Cyber security is the romanticised idea of hacking, coding and the dark web. There’s an influx of people chasing a career in cyber security who would never consider an “IT career”. But in reality, security is the foundation of modern IT. It’s baked into everything the IT Manager does, from passwords and MFA to firewalls and port filtering. Cyber security is, fundamentally, the protection of IT assets and information. 

Answering the Question: “What Are We Doing for Cyber Security?” 

Every IT Manager knows this one. It’s the question on the lips of executives and business owners up and down the country. Every day there’s a new data breach, hack or system vulnerability in the news. They want reassurances that their business is protected and safe from the world of threats out there.  

It’s not always the easiest question to answer. Non-technical executives do not want to hear about firewall rules and least privilege access. They want peace of mind that a comprehensive program is in place to protect the business and they want to see reports to back it up. Queue the cyber security consultancy who run a port scan, provide a report and charge you £5k for privilege. But are you any better protected? 

Implementing a Cyber Security Foundation: A Guide for IT Managers 

There is a better way—one that IT Managers, with their technical knowledge and skills, can implement effectively. While dedicated cyber security companies have their value, they are not a substitute for implementing a solid security foundation within your business.

 

1. Framework 

Adhere to a recognised cyber security framework. As a minimum, aim to meet the controls set out in the Cyber Essentials framework. Cyber Essentials is a UK government-backed scheme designed to protect businesses from the most common cyber threats. Once you’ve achieved Cyber Essentials compliance, you can enhance your level of protection by using frameworks with additional controls such as CIS, NIST, and ISO27001. 

Learn more about Cyber Essentials. 

Cyber Essential and CIS assessment tools available here. 

2. Assess 

Your cyber security toolkit should consist of practices and tools that allow you to measure and report on your security exposure at any given time. The EDIT Cloud portal, for example, includes online assessments with instant remediation plans, dark web monitoring to detect leaked company data, and vulnerability scanning to identify weaknesses in your network. 

Using your tools of choice, complete an assessment, run scans, analyse the data, and work through your action plan to correct any issues. 

3. Governance 

Implement policies, best practices, and controls for every element of your IT environment. You could have the most advanced security tech in the world, but all too often, the cause of a hack is a simple oversight, like a third-party service account that was never disabled.

4. Train  

50% of UK businesses experienced a breach or cyber-attack in the last 12 months, with phishing being the most common type of attack (84%). Humans are often the weakest link in the cyber security chain. Implement a user awareness training program supported by simulated phishing campaigns to reduce your human risk level. 

More information on Human Risk Management (HRM). 

5. Repeat 

Your tools and procedures should provide a consistent and repeatable way to assess, correct, monitor, and improve your cyber security. The frequency of scans and assessments will vary depending on your business type and industry, but a good practice is to complete assessments quarterly, vulnerability scans every 1-3 months, and user training every 4-6 months. 

  1.  

  2.  

Scroll to Top