• Blog
  • Support Portal
  • Careers
214.297.2100
Axxys Technologies
  • About Us
  • Services
    • IT Support Services
      • Managed IT Services
      • Co-Managed IT Services
    • Backup and Disaster Recovery
      • Case Study | Financial
    • Office 365
      • Case Study | Health Care
      • Case Study | Commercial Furniture Design
      • Case Study | Financial
    • Voice & Collaboration
      • Case Study | Automotive
    • Strategic Consulting
      • Case Study | Financial Advisory
    • Cisco Meraki Wireless
      • Case Study | Private School
    • Cloud
  • Security Services
    • Managed Security Services
      • Cybersecurity Solutions
      • IT Compliance
      • Vulnerability Management
    • IT Security Assessment
  • Our Process
  • References
  • IT Research
  • Past Projects
  • Contact Us
  • Blog
  • Support Portal
  • Careers
  • Menu
Crown Jewels

A New Era in Cybersecurity – Assume Breach Mentality

February 2, 2021/in Security /by Axxys Technologies

As we kickoff a new year of 2021 and begin marching towards this year’s goals and objectives for success, I wanted to share thoughts and feedback around the ever-growing elephant in the room called cybersecurity. It has been a challenge for small businesses for many years, and unfortunately the silver bullet to solve all the risks and vulnerabilities has yet to be found.

Many organizations have continually improved their cybersecurity defenses over the past few years as a constant stream of breaches and hacks have monopolized the headlines around the world. So, what is next in 2021 in relation to cybersecurity? In short, more of the same. The cat and mouse game will continue, blue teams (defense) and red teams (offense) will get better. The cats will catch some of the mice, the mice will outsmart some of the cats, and around we will go.

There are two concepts that I want to share which I believe will significantly alter the strategy for your organization and the effectiveness of its cybersecurity. They are “assume breach” of “the crown jewels”. Let us dive into each of these a little bit more.

Assume Breach

If we start with “assume breach”, we are shifting our strategy for building our cybersecurity program with the mindset that we have been, or will be, breached by a threat actor. In most cybersecurity breaches that are publicized, we often find out that threat actors have been soaking in the environment for months. This persistent access allows them to move through the organization and its digital assets locating, identifying, and evaluating what is critical to the organization, allowing them to establish the best plan for extracting value.

  • Some threat actors will attempt to stay in the system undetected, siphoning off personally identifiable information that is then sold on the dark web.
  • Others will extract trade secrets or other intelligence that could be sold to competitors.
  • Or some just monitor transactions such as email and accounting looking for the big payday when they can launch their attack.

In these cases, the threat actor has already gotten through the cybersecurity defenses or controls intended to protect the system. So, what would it look like if we started planning with that mindset? Would we do things differently? Would we implement more controls that are closer to the “crown jewels?”?

The Crown Jewels

Often the most basic of items are overlooked or not scrutinized because of the technical controls (the flashy items) that are installed. We believe that the firewall and antivirus will be enough. That simply is not the case, and taking this assumed breach approach means we might take more time evaluating controls such as:

  • Multifactor authentication on any public facing access point that leads to data.
  • Stronger access controls such as data classification and labeling.
  • Deeper adoption of data encryption and data loss prevention.
  • Continuous monitoring of systems using a Security Operations Center (SOC)
  • Deployment of more advanced tools like endpoint Managed Detection and Response (MDR)

All in all, the goal is to protect the “crown jewels” of the organization, whether that is data, knowledge, product, etc. But what if you do not know what the crown jewels for the organization are? If that is the case, ask yourself this one question….

  • If the entire system is down when you arrive to work tomorrow, what are you going to ask your team to focus on first?

This simple question should lead you to what is most important for the organization to be operational and to be providing the goods or services that your clients or community rely on. With this information in mind, you can then explore the assumed breach mentality to arrive at a fair evaluation of your existing cybersecurity defenses. If you have anxiety during this process, do not worry, that is to be expected. The goal is that by the end, once you have identified the crown jewels and worked through the assumed breach exercise, you will have more confidence in your existing controls or a better action plan to develop the necessary cybersecurity defenses to protect your organization.

At Axxys Technologies, Inc. we have invested considerable resources in building our team to help support your needs in information technology (IT) and cybersecurity. We are here to assist you in exploring concepts like these to ensure your organization has the peace of mind it needs to move forward in these times of seemingly endless cyberattacks. Contact our team today to review your needs related to IT and cybersecurity.

Tags: breach mentality, cybersecurity
Share this entry
  • Share on Facebook
  • Share on Twitter
  • Share on Google+
  • Share on Pinterest
  • Share on Linkedin
  • Share on Tumblr
  • Share on Vk
  • Share on Reddit
  • Share by Mail
You might also like
CyberSecurity Threats & Protection
cybersecurity 5 Ways You Can Enhance Your Cybersecurity
person working on projects The Importance of Business Security
are you ready? 4 Telling Cybersecurity Trends You Should Know
6 written steps to building your cybersecurity strategy. 6 Steps to Building a Sound Cybersecurity Strategy
ransomware attack How to Avoid Ransomware: Your 3-part Guide
Antivirus program running code. What You Need to Know about Antivirus Programs
Compass on keyboard The Essential SMB Technology Guide

Recent Posts

  • A New Era in Cybersecurity – Assume Breach Mentality
  • Is a Managed Security Services Provider (MSSP) Right for Your Organization?
  • The Long Way Up: Lessons from An Impossible Journey for Business
  • Where Do Business Owners Even Start with Cybersecurity?
  • How to Get Hacked: Security Worst Practices
Axxys logo
Call Us Today: (214) 297-2100
Customer Support
5850 Granite Pkwy #700 Plano, TX 75024 USA

Stay Connected

Be the first to know about new Axxys’ IT support and security services to help you meet your business goals

  • *We respect your privacy. We'll NEVER sell, rent or share your email address.
  • This field is for validation purposes and should be left unchanged.
© 2020 Axxys, Inc | Privacy Policy | Back to top
  • Privacy Policy
  • Privacy Policy
Is a Managed Security Services Provider (MSSP) Right for Your Organization?
Scroll to top