Password news is a hot topic for IT security professionals and managers. When you think about the damage that a compromised password can do, this scrutiny is no surprise. There’s a problem with how most companies manage password news. They hear about these incidents in the news media or from colleagues at other organizations and then make a dangerous assumption.
The Dangerous Assumption You’re Making About Password News
In brief, assuming that your organization has nothing to learn from password news is a significant fault. Simply because your organization has not suffered from a specific problem yet does not mean you will never suffer from it. To help you foster a culture of continuous improvement, you need a process to integrate continuous monitoring and actively take lessons from those experiences.
Learning From Password News and Other IT Security Events
Use this step by step checklist to make sure you get the most benefit possible from every IT security news event you monitor. Think of it this way: if you can learn from another organization’s security problems, that is one less security incident for you to manage.
1) Determine your IT security topics of interest
Monitoring everything that happens in the IT security environment is not feasible for most companies. Therefore, we recommend narrowing your monitoring focus on technologies and areas where you have significant exposure. For example, a recent IT audit may have pointed out problems in identity management and password management. In that case, you will want to focus on password news. In the next step, we will cover how to monitor the news.
2) Set up news alerts for IT security topics
There are several techniques available for monitoring industry news, depending on your resources. At the most basic level, you can set up a keyword-based alert in Google News for “passwords” and other keywords. The second option is to leverage news reports and publications from organizations like ISACA. The third option, relevant for large security-conscious organizations, is to use a third party news monitoring service.
Resource: For guidance on setting up Google News alerts, check out this guide from TechRepublic: “How to track topics with Google Alerts and Inbox by Gmail.”
3) Review IT security events every month
Now that you are monitoring for password news and related articles, you need to make time to review and analyze that news. For example, you come across a password news article like this: Important computer password warning issued after MPs admit to handing out login details to other people. To make sure you extract value from these articles, use these steps:
- Review frequency. Choose how often you will review the news articles – we recommend weekly or monthly. An hour of regular monitoring work is enough to get started in most cases.
- Adopt a continuous improvement mindset. As you read the article, ask yourself: “What lesson can I learn from this article to make my organization more effective?”
- Support collaboration. Think of one person in the organization who would benefit from reviewing the article and share it with them. Other people may see new angles and ways to learn from the event.
4) Participate in industry forums to identify new risks
Here’s the challenge with passively reading the news for new developments in password news. Organizations are highly motivated to keep these matters confidential, except where disclosure is mandated by regulation or law. As a result, there are limitations to what you can learn from the news media. Fortunately, you have another option – learning from industry groups.
We have already mentioned ISACA as a great resource for cybersecurity insights. However, it is not the only such group. In the financial services industry, there are specialized groups like the Financial Services Information Sharing and Analysis Center. Take a few minutes to ask around in your network for industry groups where you can learn further IT security news.
5) Refresh your IT security strategy annually with new information
Your IT security strategy describes your goals for the company and how you will meet them. Also, that document should recognize, assess and respond to new threats. That’s why we recommend you make a note to update your security strategy based on the latest threats you’re finding. For example, if you find articles that multi-factor authentication (MFA) is becoming more accepted by customers, you may make MFA into a corporate priority project.
6) Respond to major IT security news events quickly
This is a special step we recommend to respond to major security events in the news. For example, did you read about the Capital One cybersecurity event? In 2019, the company suffered a major data breach. According to CNN, “a hacker gained access to 100 million Capital One credit card applications and accounts.” In this case, the hacker took advantage of configuration errors related to AWS (Amazon Web Services). If your organization relies on AWS, there is an excellent reason to step up your efforts when you respond to this news.
How do you know if a major security event has occurred? These are often reported in the technology and general business news media. When these events occur, look for specific technologies and other similarities between your organization and the one featured in the article. If the event involves a critical technology like AWS, you may want to start an immediate review of your systems to determine your risk exposure.
What If You Don’t Have Time To Monitor and Assess Password News?
Systematically monitoring the Internet and press for password news and other articles of interest does take some time. If your IT security team has no capacity for this work, you need help. This is a perfect time to implement an IT security automation tool like Apollo. It can handle routine tasks like password administration so your professionals have more time to monitor the environment for threats.
For your security program to succeed, you need to carve out time for proactive monitoring, testing and training. Using an IT security automation solution is one way to give your team the breathing space needed to take on this work.
