{"id":514168,"date":"2022-05-03T08:58:10","date_gmt":"2022-05-03T06:58:10","guid":{"rendered":"https:\/\/www.devoteam.com\/expert-view\/automate-your-cyber-security-and-put-your-resources-to-better-use\/"},"modified":"2022-05-03T08:58:10","modified_gmt":"2022-05-03T06:58:10","slug":"automate-your-cyber-security-and-put-your-resources-to-better-use","status":"publish","type":"expert-view","link":"https:\/\/devoteam.info\/lu\/expert-view\/automate-your-cyber-security-and-put-your-resources-to-better-use\/","title":{"rendered":"Automate your cybersecurity and put your resources to better use with ServiceNow"},"content":{"rendered":"\n

Managing cyber security risks remains an uphill battle. Threats keep growing in numbers, as well as sophistication, and most cyber security departments are already overloaded.<\/p>\n\n\n\n

\n
\n

3 main challenges<\/h2>\n\n\n\n
\n
\n
\n

1<\/strong><\/p>\n\n\n\n

Increasing compliance requirements and external threats
<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

2<\/strong><\/p>\n\n\n\n

Shortage of skilled cyber security professionals
<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

3<\/strong><\/p>\n\n\n\n

An opaque and ever-changing IT infrastructure<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

Compliance demands drain security resources<\/strong><\/h3>\n\n\n\n
\n
\n

Obviously, it makes good sense to comply with requirements issued by various authorities. Still, if you look at it from an organisation\u2019s security point of view, spending too much time gathering evidence to report on compliance, actually weakens the effort to protect the organisation from emerging threats.<\/p>\n\n\n\n

Sure, the measures required by the regulations are often reasonable but compliance also requires an immense amount of effort for documentation and reporting. The organisation is often requested to provide information that very soon becomes obsolete due to the ever-changing situation. That is \u201cpseudo-security\u201d, draining the organisation’s security resources while it does not increase the level of protection. This can be done smarter.<\/p>\n<\/div>\n\n\n\n

\n
\"\"<\/figure>\n<\/div>\n<\/div>\n\n\n\n

Chronic lack of skilled workers seriously depletes security measures<\/strong><\/h3>\n\n\n\n

According to the 2021 Cybersecurity Workforce Study<\/a> from the (ISC)2<\/sup>, the size of the global cybersecurity workforce is 65% below what it needs to be, and there is no prospect of significant improvement. This considerable deficit in the staff impacts the organisation\u2019s effort to maintain an acceptable level of security. Because of this lack of cyber professionals, we have to work smarter. Do more quality work with fewer hands.<\/p>\n\n\n\n

Insufficient insight into IT systems makes them hard to defend<\/strong><\/h3>\n\n\n\n
\n
\n

You can only protect what you know, but security managers usually do not have an updated and complete rundown of the IT landscape. It is a complex set of systems located in separate interconnected entities. Moreover, the IT infrastructure and IT applications change constantly, requiring regular updates. So, how many people need to be involved to predict and assess upcoming risks in a constantly changing business and IT environment? Risk management becomes a very difficult task if it is to be performed manually and nearly impossible to maintain afterward.<\/p>\n<\/div>\n\n\n\n

\n
\"\"<\/figure>\n<\/div>\n<\/div>\n\n\n\n

These profound challenges are not just a problem for the specific organisation; they are a societal threat. Cybersecurity is the frontline of the 21st century, and if organisations cannot defend themselves, much more is at stake: Our economy, democracy, and our way of life.<\/p>\n\n\n\n

Three ways to free security resources<\/strong><\/h2>\n\n\n\n

What is the way forward?<\/strong><\/h3>\n\n\n\n

The common denominators for the above challenges are a deficit of resources and reliable data. To reduce these deficits substantially, we suggest working smarter and enabling technology to free up time to work with essential protection. Such an approach does not require large investments in technology or programs. Most organisations already have the necessary technology tools to improve their situation. Enterprise Service Management (ESM) platforms, like ServiceNow\u00ae<\/sup>, are traditionally used to manage IT services in the organisation. Today, ServiceNow is an automated workflow platform that is able to collect and connect data, control workflows and deliver real-time reporting. Therefore, ServiceNow is the ideal platform to orchestrate and automate your security and compliance processes. It allows you to free up time for your security professionals, so they can focus on protection, detection, and response. How would that work? With automation, crowdsourcing, and system utilisation.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
<\/div>\n\n\n\n

Automation<\/strong><\/h3>\n\n\n\n

The primary reason why evidence collection and documentation for compliance purposes are such a drain on resources is that most of the work is done manually. But usually, most of the information is already accessible from the IT systems, so why not create automatic processes to collect the data and present the results? <\/p>\n\n\n\n

You need to remember that the compliance process is mostly repeatable and predictable actions and therefore easy to automate, especially with ServiceNow. That way you avoid disturbing your business users by asking unnecessary questions you already can retrieve the answers to.<\/p>\n\n\n\n

Crowdsourcing<\/strong><\/h3>\n\n\n\n

For a central Governance, Risk and Compliance (GRC) function with limited resources, it is highly challenging to protect the organisation appropriately. But GRC can expand its resources through crowdsourcing so that the protection becomes an actionable issue for the entire organisation. Crowdsourcing would work by allocating relatively small tasks to a rather large amount of people. That way, you are taking advantage of the knowledge and skills from people who are part of the business process or users of IT systems and have firsthand knowledge. <\/p>\n\n\n\n

The tasks must be:<\/p>\n\n\n\n