Small business not necessarily weakest security link
Half of the large enterprises view third-party partners of any size as a cybersecurity risk, according to the latest Securing the partner ecosystem study by security professionals’ association (ISC)2.
However, only 14% have experienced a breach as the result of a small business partner, while 17% have been breached as the result of working with a larger partner, the poll of more than 700 security professionals across North America reveals.
These findings contradict the widely held belief that small businesses serve as the easiest conduit for cyber attacks against large enterprises, with 94% of respondents saying they are “confident” or “very confident” in their small business partners’ cybersecurity practices, while 95% said they have a standard process for vetting their suppliers’ cybersecurity capabilities.
“This research highlights the fact that building a strong cybersecurity culture and subscribing to the right best practices can help organisations of any size maximise their security effectiveness,” said Wesley Simpson, (ISC)2 chief operating officer.
“It’s a good reminder that in any partner ecosystem, the responsibility for protecting systems and data needs to be a collaborative effort, and multiple fail safes should be deployed to maintain a vigilant and secure environment. The blame game is a poor deterrent to cyber attacks.”
Nearly two-thirds (64%) of large enterprises outsource at least a quarter (26%) of their daily business tasks, which requires them to allow third-party access to their data. These outsourced functions can include anything from research and development to IT services and account payable.
This data access and sharing are necessary as a large enterprise scales its operations, but the research indicates that access management and vulnerability mitigation is often overlooked.
More than a third (34%) of large enterprise respondents said they have been surprised by the broad level of access a third-party provider has been granted to their network and data, while a similar proportion (39%) of small business respondents expressed the same surprise about the access they were granted when providing services to large enterprise partners.
The study also shows that 35% of large enterprise respondents admitted that when alerted by a third party to insecure data access policies, nothing changes in the large enterprise’s practices, while 55% of small business respondents reported that they still had access to a client’s network or data after completing a project or contract.
More than half (54%) of small business respondents have been surprised by some of their large enterprise clients’ inadequate security practices, and 53% have provided notification of security vulnerabilities they have discovered in large enterprise networks.
The report found that while small businesses have fewer employees overall, the proportion of their cybersecurity staff is not necessarily lower than in large enterprises. Nearly half (42%) of small businesses, with 250 or fewer workers, employ at least five dedicated cybersecurity staff.
By comparison, 75% of large enterprises, with more than 1,000 employees, have at least 10 staff members focused on cybersecurity. This means that some small businesses have a higher percentage of security professionals working to implement best practices and defend data and networks.
The study found that, while they may have differing toolsets, small businesses and large enterprises approach data protection similarly by focusing on many of the same cybersecurity best practices.
Both sets of respondents indicated that they employ the same top three best practices to protect their networks and data:
- Regular automatic scans with antivirus and anti-malware programs.
- Blocking access to known malicious IP addresses through firewall configuration.
- Strong email filters to prevent phishing.
The report concludes that enterprises are just as likely to be breached through a relationship with a larger third-party supplier and that enterprises need to improve their security practices in some critical areas, specifically in relation to addressing security issues discovered by partners and removing access to systems when partners no longer need it
“Breach prevention responsibility rests with all parties in a partnership, and enterprises should have the proper layered security controls in place to defend themselves from all angles of attack,” the report said.
Creating a strong culture focused on cybersecurity is a core element in raising the bar of cyber competence and readiness, no matter the size of the organisation, the report notes.
The report cited a 2018 study by (ISC)2 which found that companies that recruit and maintain strong cybersecurity teams – and are by extension more confident in being able to defend their information systems – do it by fostering a resilient culture of cybersecurity, in which executives understand and reinforce the importance of security practices, hire certified security professionals, train and promote from within, and draft clear job descriptions when hiring.
“Size isn’t the best indicator of a company’s cybersecurity abilities or likelihood of being breached. It’s everyone’s joint responsibility to do their due diligence in working with partners when shared access to networks is concerned,” the report said.
Industry: Cyber Security
- DevOps Engineer with IdAM
- Upto £80,000 plus benefits
We are ooking for an DevOps engineer, idealy with IdAM (identity access Management) experience, this is a senior role for someone that can be the lead hands on person on a project. Your role will be to work on the deployment project implementing the solution into the exsiting application so will be used to connect an applications into mulipe 3rd party appliactions. We Would look at someone who has done DevOps with Security and can cross train into IdaM, but preference would be given to someone with the IdAM experience this is a great opportunity to join a consultancy that work on some truely amazing and differnet solutions
- Senior SOC Analyst. Level 3 Palo Alto Wildfire, Rapid 7, Fortify, Splunk.
REF CH7840 Senior SOC analyst (Palo Alto Wildfire, Rapid 7, Fortify AND Splunk) Flexible location £55,000 + Senior SOC analyst needed (Level 3) that can achieve SC clearance for a permanent role. We are looking for Level 3 SOC Analysts with two or more of the following; Palo Alto Networks Wildfire (#malware) Rapid7 Nexpose Micro Focus Fortify (#automated #applicationsecurity) AND ideally Splunk. The role will include, but not be limited to; managing and handling incidents end to end, supporting and mentoring level 1 / level 2 staff, supporting the SOC manager in the delivery of the SOC roadmap, engaging with the client stakeholders (other technical teams) as and where needed, use case development, advanced search and reporting etc. Flexible location, commutable in the future to London or Birmingham This role will sit within a public sector client so the individual must be able to achieve SC clearance. To arrange a call with Chris Holt use this calendy link https://calendly.com/chris-holt/arranged-call-with-chris-holt-remote-soc-role Chris.Holt@dclsearch.com 07884666351
- Identity & Access Management (IdAM) Consultant
- Upto €100,000 plus bonus and benefits
An Identity & Access Management Consultant is needed to lead and drive technical and or business transformation projects in a client-facing position for a prestigious consultancy in Germany. The Identity & Access Management Consultant will be responsible for technical design and implementation of Identity & Access Management/IAM products within a wide variety of clients. The Identity & Access Management Consultant will have a blend of technical hands-on and client-facing consultancy with the ability to develop new business. Broad technical knowledge across Identity and access management is benefical. The Identity & Access Management Consultant will need to have technical hands-on experience with one or more of the following core areas; Privileged Access Management (PAM, CyberArk, Beyondtrust, Thycotic) Identity Governance Administration (IGA, Sailpoint, Omada, RSA) Customer Identity & Access Management (CIAM, Forgerock PSD2) The Identity & Access Management Consultant must have the willingness to travel to customer sites across Germany.
- PCI DSS Security Specialist, Level 1 Service Provider,
CH7827 Payment Card Industry DSS Security Specialist, Level 1 Service Provider End User. £75,000 Flexible location, ocassional travel to London- Covid permitting Payment Card Industry DSS Security specialist needed to join a Security team to work with a highly respected CISO within a Level 1 Payment Service Provider. The PCI- DSS Security Consultant will have end to end responsibility for PCI - DSS and its continuing certification. 2021 / 2022 plan is to transition PCI to the cloud. Experience must include a focus into the Payment Card Industry. A mix of Information Security standards, frameworks, audit principles, controls / policies and the management and use of the technical tooling to achieve compliance is essential. PCI objectives / 12 key requirements, OWASP top 10, ISO 27001, NIST Cybersecurity Framework etc An ideal candidate will be working within an end user environment with a cyber consultancy background. PCI Cloud compliance, specifically someone with experience taking PCI-DSS from on premise into the cloud is HIGHLY desired. However, someone with Solid PCI experience with a strong technical background which include Cyber / Secure by design etc would be considered. Experience managing internal stakeholders and external third parties essential. Flexible working, but with the ability to get into London. This is an exclusive role to DCL Search & Selection. Arrange a call with Chris Holt on https://calendly.com/chris-holt/arrange-a-call-chris-dcl-pci-compliance