Instilling the Hacker Mindset Organizationwide

Tim Chase, Global Field CISO, Lacework

April 2, 2024

3 Min Read

Source: Anna Berkut via Alamy Stock Photo

COMMENTARY

The saying “put yourselves in the shoes of a hacker” has long been part of defensive security strategies. Today, in the fast-paced and evolving threat landscape, this statement is truer than ever for chief information security officers (CISOs) and security teams at scale.

As cyber threats continue to evolve in 2024, CISOs and security teams must be prepared for everything from supply chain risks to zero-day exploits to deepfakes to cloud targeting and more. By ensuring visibility across your infrastructure, encouraging employee training, and supporting bug bounty programs, your organization will harden its security posture and be better prepared to fend off rising threats this year. Let’s dive a bit deeper into each:

Creating Security Allies Out of Your Team

Recent cyberattacks have shown us that the level of sophistication and damage caused by malicious actors is not slowing down. The MOVEit data breach that leaked the personal information of more than 11 million people shows the raw scale of modern attacks. Similar breaches at MGM and Caesars were exacerbated by the FBI struggling to stop the cyber gang behind the incident.

While the security team can’t befriend everyone in an organization, they can focus on education internally in order to train staff on risks and create clear communication that covers important issues. If hackers are staying up to date and getting educated on the latest threats and risks, we should as well. Creating a “security champions” program across the organization is a great way to embed security. One team member from marketing, finance, legal, etc., can plug in to your team and be a liaison for security that helps push pertinent cybersecurity information out across the company.

Supporting Bug Bounty Programs

Rather than being anxious and shunning bug bounty programs, CISOs and security teams should reward good behavior. I encourage employees to attend hackathons — even if it’s only to observe or learn at first. It’s one step in the right direction for security education. For more hands-on cybersecurity learning, I also like to arrange company-wide competitions and games that encourage employees to figure out how cybercrime could potentially happen.

There is no better way to prepare for a real breach than with a simulation. It forces the team to work together, strategize, and agree on a solution. The increased need for internal cybersecurity education and support for bug bounty programs is only going to continue growing in order to keep up with rising threats.

If All Else Fails, Focus on Visibility

Visibility is a foundational principle that suggests you can’t secure what you don’t know about. Lack of a security team’s visibility is a gold rush for hackers because they typically infiltrate an organization’s network via hidden or sneaky entry points. If you don’t have visibility, there will undoubtedly be a way in. Without visibility into all traffic within an organization’s infrastructure, threat actors can continue to lurk in the network and grant themselves access to the organization’s most sensitive data.

With 93% of malware hiding behind encrypted traffic but only 30% of security professionals claiming to have visibility, it’s no wonder that there were more ransomware attacks in the first half of 2023 than in all of 2022. Once a cybercriminal has made their way into the network, time is limited. Only with visibility can the cybercriminal be stopped from wreaking havoc and gaining access to company data.

When cybersecurity professionals can better understand the mysterious nature of hackers and how they work, they can better protect their own systems and valuable customer data. It’s critical to stay vigilant not only when it comes to major security issues, but also with minor lags in security best practice. We saw this with the recent breach of Hewlett Packard, which was undertaken by the same group behind 2020’s SolarWinds breach. Some of the most sophisticated cybercriminals are also incredibly opportunistic, taking advantage of any split-second lapse in otherwise-tight security plans. Ensure you take the steps above to stay ahead of looming threats.

About the Author(s)

Global Field CISO, Lacework

Tim Chase is the Global Field CISO at Lacework and has worked in information security for over 15 years in various roles, including leading security teams focusing on Cloud and AppSec. He has extensive experience working at the board and executive level to promote security and guide decision-making.