 practicing effective cybersecurity practicing effective cybersecurity hemraj wed 10152025 503 practicing effective cybersecurity laszlo s gonc submitted by hemraj on mon 10132025 626 laszlo s gonc cissp first senior fellow divihn cybersecurity center of excellence linkedin url linkedin perspectives tag security in the digital dna expert content laszlo sgonc sort by trending latest practicing effective cybersecurity laszlo sgonc security in the digital dna trending latest image c ybersecurity can be a complex and overwhelming discipline there is much written about every aspect ranging from how to effectively train your workforce to the reidentification of anonymized data to threat detection adding to the cybersecurity fog is complex technology environments that constantly change to accommodate the pace of business and digital transformation needed to remain competitive the intent of this post is to share thoughts on how to rationalize cybersecurity governance technical controls and processes and focus on what s important to your business while blocking out the noise management of cyber risk is at the center of cybersecurity understanding the cyber threats to your business the likelihood of them materializing and their potential impact financial reputational is fundamental casinos steel manufacturers hospitals research organizations all face cyber threats granted some of the threats may be more pronounced and the impact more catastrophic but they all must understand the risk technology brings to their business the cybersecurity rationalization diagram describes the rationalization process at a highlevel thoughtfully addressing these areas will help you effectively manage risk does this guarantee there will be no cybersecurity incidents or breaches absolutely not technology environments are too complicated some technologies eg tcp ip are inherently insecure and humans well are humans taking these steps will reduce the number of incidents and their impact on your business cybersecurity rationalization  to understand cyber risk we must first identify the data collected and technology services provided the sensitivity of data collected and critical nature of services influence business risk tolerance business leaders must determine their business risk tolerance will a breach or cybersecurity incident lead to reputational damage and significant loss of revenue will a breach result in significant harm to individuals eg expose extremely sensitive information if so the business risk tolerance should be low business risk tolerance influences the level of cybersecurity controls implemented cybersecurity controls range from identity and access management to endpoint protection to cloud security security monitoring threat detection and incident response is also included in the scope of cybersecurity controls risk averse organizations may require more extensive cybersecurity controls to reduce cyber risk threats to data and technology services are another factor that influence cybersecurity controls a reasonable understanding of bad actors and associated threats to your business is required this is important because it helps to identify blind spots vulnerabilities increase cyber risk the importance of vulnerability management can t be overstated bad actors exploit some type of weakness be it technical or humanbased to accomplish their goal identifying prioritizing and remediating vulnerabilities is critical proactively addressing technical debt reduces the vulnerability management challenge regulatory eg hipaa and customer contractual requirements contribute to business risk as noncompliance can result in fines and other damages these requirements must be considered but should not drive definition of cybersecurity controls leading practices relevant threats and risk tolerance should guide effective cybersecurity if the disciplines outlined above are addressed in a thoughtful manner the outcome is effective cyber risk management a continual focus on threats vulnerabilities and effectiveness of controls while considering business risk tolerance will create the right culture combining this with cybersecurity governance will ensure alignment as the business needs change this is a highlevel view into how to approach cybersecurity and manage cyber risk in reality each one of these disciplines eg threat management vulnerability management require a focused effort to implement the needed capability the challenge is balancing cybersecurity with cost productivity and user experience to reasonably protect data and services and minimize the risk to people society and business there is no easy answer to meeting this challenge it s a journey not a destination we live in a hyperdigital age and technology is critical in all aspects of our lives effective cybersecurity is more important than ever  