5 Cybersecurity Tips So You Can Sleep at Night

By Jason Lee

There’s a joke I like to tell about what keeps C-level executives up at night. The shorthand version is that unlike the rest of the leadership team, the CISO’s bed is made but no one sleeps in it.

It’s been almost two months since I joined Splunk as Chief Information Security Officer and my team has been focusing on Splunk's own foundational security and continuing our ongoing efforts to protect our customers – so security isn’t the thing keeping them up at night. The reality is that it’s not if a breach or exploit will occur, it’s when. So organizations need to be ready to respond and recover when an incident occurs.

Here are five tips on preparing for a cyberattack.

Nail the Basics

The first line of defense is ensuring employees are informed and routinely trained on security policies. Strong passwords updated regularly, phishing prevention training and keeping systems and applications patched and up to date go a long way toward preventing a breach. Keep data encrypted and backed up, and segregate backups so a cyberattack can’t spread. And having a solid asset management strategy enables businesses to identify core critical assets and determine how to secure that data.

Know Who’s Who and Who Can Access What

Operate with a zero trust strategy and authenticate and authorize every user, device and interaction to verify everyone and everything across the business. Implement data governance so people only have access to data and technology relevant to their role. Inventory your data regularly so that you understand where sensitive information resides and who has access to it. Besides keeping passwords updated, implement multi-factor authentication whenever possible to help ensure that legitimate users are accessing systems and data. Practice routine user maintenance to add, update or remove users to help maintain data governance.

Look at Your Data Big Picture

Understanding your data is more than collecting logs and seeing activity. It’s taking in all the different data to understand the big picture and gaining end-to-end visibility across the environment. To be cyber resilient, you need a data-centric security operations portfolio that collects all forms of data, quickly analyzes and responds to risks, has built-in threat intelligence, easily integrates with existing tools sets without creating more data silos and scales with the business.

Have a Plan

As Benjamin Franklin said, “By failing to prepare, you are preparing to fail.” Develop an incident response plan to investigate, contain and remediate a security incident or breach. Having a plan in place helps you make faster, informed decisions to reduce risk exposure. But don’t stop there. Set up an incident recovery plan to outline how to restore your business. And if an attack occurs, gather your teams to figure out how risk was missed to put future protections in place. Save time and cost of recovery by having plans in place.

Communicate

Know who you’re going to call and how you’re going to tell customers. Ensure that everyone knows what to do and can carry out the plan if a cyberattack occurs. Identify who gets called, develop technical responses for customers and know who the decision makers are in your organization. The smoother you handle incidents internally and externally, the better for your customers and your bottom line.

When it comes to security, it pays to look ahead and be prepared. Before joining Splunk, I was a Splunk customer. If you want to find out how using Splunk helped me sleep at night, get in touch.

Jason Lee

Jason Lee is Vice President and Chief Information Security Officer at Splunk. A highly respected technology executive with 20 years of experience in information security and operating mission-critical services, Jason led security for large enterprises prior to joining Splunk including Zoom and Salesforce, where he led the delivery of critical end-to-end security operations including company-wide network and system security, incident response, threat intel, data protection, vulnerability management, intrusion detection, identity and access management and the offensive security team. Before that, he spent 15 years at Microsoft and held various senior leadership roles, including Principal Director of Security Engineering for the Windows and Devices division, as well as Senior Director of Developer Services. As Senior Director of Developer Services, he oversaw the design and management of the mission-critical PKI for all products across the company. Lee holds a B.A. from Washington State University.

Leadership 3 Min Read

A More Resilient Digital World, Through the Power of Us

At Splunk, we lean into the power of us – all the things that make us who we are, working together in an environment that supports and trusts.

Leadership 2 Min Read

Let's Go!

Take a look as new Splunk CEO Gary Steele shares his vision for Splunk and how we can help customers do even more with their data.

Leadership 2 Min Read

Biased Language Has No Place in Tech: A Follow-Up

Splunk's Garth Fort shares an update on how we're reinforcing our commitment to ensuring inclusivity – even in our products.

About Splunk

The Splunk platform removes the barriers between data and action, empowering observability, IT and security teams to ensure their organizations are secure, resilient and innovative.

Founded in 2003, Splunk is a global company — with over 7,500 employees, Splunkers have received over 1,020 patents to date and availability in 21 regions around the world — and offers an open, extensible data platform that supports shared data across any environment so that all teams in an organization can get end-to-end visibility, with context, for every interaction and business process. Build a strong data foundation with Splunk.

Learn more about Splunk