CIS Control 14 Webinar | Featuring Connor Swalm, Jimmy Hatzell, & Wes Spencer | Phin Security

TL;DR

This analysis discusses the importance of security awareness and skills training for the workforce, focusing on CIS Control 14.

Transcript

so should we kick things off here yeah yeah we can kick things off right now uh i just started the recording so you guys should see the recording in the top left also let me make a note getting things started glad you got that out of the way you know it's like we've been doing these webinars for so long and every every time somebody's like is this ... Read More

Key Insights

• 🔒 CIS Control 14 focuses on the importance of securing the workforce through security awareness and skills training.
• 🔒 Compliance does not guarantee security, and organizations must strive for effectiveness, not just compliance.
• 🔒 Buy-in from leadership and employees is crucial for the success of a security awareness program.
• 👋 Understanding the organization's critical data and its flow is essential for implementing data handling best practices.
• 🔒 Reporting potential security incidents and engaging employees in creating a culture of security is vital.
• ✳️ Patching software and updating systems regularly is crucial to reducing the risk of cybersecurity incidents.
• ✳️ Recognizing and avoiding insecure networks is important, as is educating employees on the risks of using public Wi-Fi.

Questions & Answers

Q: Why is compliance not enough for achieving effective cybersecurity?

Compliance focuses on meeting specific standards or regulations, but it does not necessarily address all security risks. Effective cybersecurity requires proactive measures, continuous training, and awareness to ensure the workforce understands their role in protecting the organization.

Q: What are the key elements of an effective security awareness program?

An effective security awareness program includes assessments, training, and buy-in from both leadership and employees. It should focus on the specific needs and risks of the organization, encourage reporting of potential incidents, and foster a culture of cybersecurity.

Q: How can organizations go above and beyond compliance in their security awareness programs?

Organizations can go beyond compliance by creating engaging and interactive training modules, involving employees in training program development, and ensuring continuous improvement based on feedback. They should also prioritize employee buy-in and provide incentives for reporting potential security incidents.

Q: What are some unintentional causes of data exposure that employees should be aware of?

Employees should be aware of leaving confidential information on their desks, sending sensitive data to the wrong recipients, failing to remove access for former employees or contractors, and unintentionally sharing data with unauthorized individuals. Regular training and awareness programs can help mitigate these risks.

Key Insights:

• CIS Control 14 focuses on the importance of securing the workforce through security awareness and skills training.
• Compliance does not guarantee security, and organizations must strive for effectiveness, not just compliance.
• Buy-in from leadership and employees is crucial for the success of a security awareness program.
• Understanding the organization's critical data and its flow is essential for implementing data handling best practices.
• Reporting potential security incidents and engaging employees in creating a culture of security is vital.
• Patching software and updating systems regularly is crucial to reducing the risk of cybersecurity incidents.
• Recognizing and avoiding insecure networks is important, as is educating employees on the risks of using public Wi-Fi.
• Role-specific training can help tailor security awareness programs to address specific risks and responsibilities within an organization.

Summary & Key Takeaways

• CIS Control 14, also known as the security awareness and skills training control, emphasizes the significance of securing the workforce and educating them on what to do and what not to do.

• The actions of people play a critical role in the success or failure of an enterprise's security program.

• Compliance does not guarantee security, and organizations need to go beyond compliance to achieve effective cybersecurity.