Schedule a Demo

The “We Need a CISO” Conundrum – 10 Things I Hate About Cybersecurity: A Love Story

Picture of Pareto Cyber

Pareto Cyber

Cyber threats are real

Schedule a Demo

Subscribe newsletter

Hi! I am Nick Gipson, the Director of Cyber Operations here at Pareto Cyber. This is Part 3 of my 10-part series on “10 Things I Hate About Cybersecurity: A Love Story” where I dissect the problems within this industry and my personal encounters with them. You can find the other parts of this series here.  

The Issue

Many companies find themselves trapped in a Catch-22 scenario with their security operations:

  • They need somebody sufficiently experienced to oversee their entire cybersecurity program.
  • Their budget isn’t large enough to hire a great in-house chief information security officer (CISO).

Because they can’t find a solution, the entire organization’s cybersecurity is at risk.

Why It Matters

While a sharp security operations center (SOC) manager can do quite a lot to protect your business’s data, there are limits to how much they can accomplish.

Our clients often complain that their staff is falling short of their cybersecurity needs. Honestly, I’m not surprised. Most general IT and infrastructure staff don’t understand security at that level and can’t effectively deal with modern cyberthreats. 

I think one recent example from Pareto shows just how important having an experienced security specialist can be. 

We were helping a new client with a complete overhaul of their Amazon Web Services (AWS) cloud. What we saw was a complete mess:

  • Many services and accounts were orphaned. 
  • Root accounts were used interactively by their administrators
  • No MFA was implemented on user accounts
  • No VPN or SSO system was installed
  • No AWS organization global view for the account
  • No cloudtrail log forwarding to SIEM
  • No security token management

All of this mismanagement added up: the company was extremely vulnerable to data breaches. Users with AWS accounts could access the entire AWS environment. Security staff didn’t monitor logs. Even if a breach occurred, the company may not have even noticed.

When we stepped in, we worked not only on improving their AWS cloud, but also ensuring that all other parts of the business’s digital infrastructure were managed correctly. After a thorough assessment, we presented detailed reports with specific large-scale recommendations to improve the client’s cybersecurity posture both immediately and in the long term.

What Can We Do?

To solve the CISO conundrum, you need to escape the trap of requiring in-house staff for all of your security operations.

Outsourcing can provide you with the expertise that your organization desperately needs without the costs and resources that finding a full-item specialist requires. With a good vendor, you can outsource someone who can make overall security program recommendations for your organization. This kind of expert can direct the rest of your staff to ensure proper maintenance of all of your systems. 

At Pareto Cyber, we have a Virtual-CISO (v-CISO) program to serve exactly this need. We can command and control a client’s entire cybersecurity program and assist with protecting their organization in a much more comprehensive way than by simply detecting and remediating threats.

Share

Related Articles

Cyber
Hygiene
Engineer
  • Responsible for data analysis and interpretation of required hygiene data sources; Vulnerability, Identity, Patching, Device Management, Cloud, and Networking. The role of the Cyber Hygiene Engineer is to provide prioritization of risks identified in the environment. Their overall goal is to rapidly reduce client risk related to Cyber Hygiene gaps.
Threat Hunters
& Red /
Purple Team
  • A cross-functional operations and engineering team responsible for developing threat use cases based on the technologies deployed and operations within a client. Our Threat Hunters are using the latest intel technologies to understand threat actor groups and motives targeting clients and provide use cases for SIEM implementation. Then our Red/Purple team provides our hunters and platform engineers with the latest tactics being used to help clients stay ahead of the latest threats.
Strategic
Cyber
Risk Advisor
  • Our Cyber Risk Advisors are focused on analyzing data integrated and correlated within the Cylemetry platform. This analysis allows our CRAs to provide clients with strategic and tactical recommendations on reducing overall cyber risks.
Customer
Success
  • Responsible for ensure all Pareto teams are meeting client expectations, service level agreements, and taking overall feedback for service improvement.
Platform
Engineer
  • Responsible for installation, configuration, and continuous improvement of client and Pareto support technologies used during service operations. Additionally, Platform Engineers provide content development, log source tuning, and security solution tuning support.
IR
Engineer
  • Responsible for using digital technologies available to assess total risk exposure of an incident / breach, provide in-depth Eradication, Remediation, Recovery, and Root Cause Analysis (RCA) services for clients that experience a successful attack.
Threat
Intel
Analyst
  • Collect, Process, Analyze and Report on enterprise and open-source threat intelligence to track threat actors, malware strains, or phishing campaigns that may affect our clients and their industry.
Threat
Detection
Analyst
  • Responsible for management of security alerts within security technologies, internal escalation of alerts to events or incidents, development of threat reports, threat surface analysis, and support of IR Engineering, Threat Intel, and Platform Engineering.
Threat
Detection
Lead
  • Accountable for daily operations, such as Threat Escalation Management, Remediation Approval, Service Level Agreements, Customer Communications, and Root Cause Analysis.
Penetration
Tester
  • Works alongside the Threat Hunter and Threat Intelligence Analyst to build and test SIEM alert rule content, based on the newest adversary tactics.
Threat
Hunter
  • Performs prescribed threat searches within the client’s environment, reporting any findings. This skill is also considered the SME of internal client IT operations and can determine legitimate client network traffic.