The Digital Defense Report 2022, the organisational view
Aug 20th, 2023 by Jesper Kråkhede
The same report, but with management´s eyes.
The most important organisational message in the Digital Defense Report 2022 is that the threats are no longer a technical issue alone. Ransomware is described as a threat on a national level. State actors use cyberattacks as part of war. Cybercrime works as a business, with services for hire. That means security decisions are business decisions, and they need to be made at the right level.
Second, almost everything in the report points to basic hygiene. Strong authentication, protected privileged access, patching and backups. These are not expensive technologies. They are hard because they require time, people and persistence, exactly what many organisations lack.
Third, nobody can do it alone. The report talks a lot about collaboration, between companies, governments and security vendors. For a smaller organisation this means using partners and services rather than trying to build everything in house.
So what should management do? Make sure someone owns cyber risk at management level. Make sure the basics are measured and reported. Give the security team the time to do the boring work. And decide in advance who you call when the worst happens, because you won´t have time to find out during an incident.
The attackers are organised. Your defence needs to be too.