Subscribe to the Eficio newsletter and be the first to receive our updates!
The “Detect” function of cybersecurity
In previous articles in our cybersecurity for managers folder, we have discussed the “identify” and “protect” functions. This article will now cover the “detect” function. Our CISO-360 CyberRisk Control diagnostic and intervention plan identifies the detection controls necessary for proper cybersecurity risk management. These controls will be analyzed, and recommendations will be customized based on the internal capacity of your IT team.
Pierre Farley
Eficio Partner and CIO
The “detect” function is a layer that overlaps the two functions previously discussed (“identify” and “protect“). Detection consists of data collection, setting up an alert system, and event validation operations. The goal of detection is to quickly discover a cyberattack event. The key to successful detection relies on logging and automating controls.
Law 25, which focuses on the protection of personal information, obliges organizations to inform individuals affected by an intrusion or theft of data. Therefore, the “Detect” function must put rigorous controls in place for the identification of personal data and access to this data.
Since all organizations face cyberattacks daily, cybersecurity detection is a necessary and continuous task, even when performed in real-time.
What are the key elements of the “detect” function?
• Anomalies and Events – Collect and analyze data from your systems. This can represent a high volume of data to validate. You must ensure that your IT team has the knowledge and time required to perform the task. Data collection and centralization tools can simplify the task;
• Security and continuous monitoring – 24/7 monitoring of your systems, preferably in an automated way. This can be accomplished by specialized solutions or partners who will have a real-time eye on your systems;
• Detection process – How and what to detect/validate. This aspect can be demanding. Not all alerts have the same level of risk and how to ensure that a legitimate alert is detected in time? Specialized solutions based on artificial intelligence are an important asset to consider.
At Eficio, we have observed that while tools and controls are often implemented to fulfill the detection function at the data collection level, but they are frequently only briefly used during the validation and detection stages of cybersecurity events.
Effective detection requires the logging of a high volume of data, and today’s smart tools use artificial intelligence (AI) to cross-check data and identify risky behavior in various systems. However, simply using the right tools is not enough. It is not uncommon for organizations to have deficient data validation, even when using such tools. Often, this task is delegated to an IT support team that prioritizes user support and project completion, leaving cybersecurity tasks neglected.
Our cybersecurity experts can offer you solutions that go beyond simply identifying gaps in your detection function. There are various organizational solutions available that can help increase security monitoring. The CISO-360 Cyber Risk Control is more than just a diagnosis; it is a solution-oriented approach that takes into account the realities of your organization. The management experience of our stakeholders is the cornerstone of our approach, and it sets us apart.
If you would like to comment to this article or obtain further information, please do not hesitate to contact Eficio. You can access all the articles in our folder by following the links below: