What does it mean to have good cyber hygiene?

Ask a cybersecurity expert for advice on how to secure the tech stack, and chances are good they’ll say something about minding the basics. But what does it really mean to invest heavily in security fundamentals?

Joseph Perry, advanced services lead for Arcova, told IT Brew that the answer to perfecting the basics of good cybersecurity hygiene is to have the necessary expertise to use data resources, shape appropriate responses, and apply solutions in real time.

Many organizations, Perry said, might implement phishing tests, and collect metrics on users’ cybersecurity awareness, all while ensuring continued cyber-education, but “none of those things correlates to increased or improved outcomes” for an organization’s cybersecurity.

“The way you get brilliant at the basics is you start measuring your outcomes in a very concrete way,” Perry said. “You say, ‘Our SOC is currently capturing 50 alerts a day, we know we’re a very large organization, we should be seeing a lot more activity than that, we need to look at our detection engineering.’”

Brilliance in motion. Both Gary Brickhouse, CISO at GuidePoint security, and Omar Santos, distinguished engineer at Cisco, agree that the best basic practices for cybersecurity hygiene start with visibility and inventorying an organization’s environment.

If a security team or IT department doesn’t have the full breadth of knowledge of every component, Brickhouse said, there are blind spots and potential vulnerabilities. However, the shifting landscape of new tools and capabilities means enterprises must have continuous monitoring to defend against shadow IT and other issues—which can lead to its own challenges.

“That really is such a critical piece to provide, the visibility that we need to make sure that we are appropriately patched, that we do have this continuous vulnerability management program, that we are getting the right logs from the right systems,” Brickhouse said. “If we don’t have visibility into it, we don’t know that it exists, it has to start there.”

According to Santos, organizations should lean into another crucial cybersecurity fundamental: control. This extends to identity, authorization, boundaries, and isolation of services, all of which can help best manage environments.

“Whether it’s the classical application, or an AI agent that you created yesterday, you need to know what boundaries are in place for them to access information, and that comes into the control area,” Santos said.

The basics: To be “brilliant at the basics,” cybersecurity pros should consider the following:

• Prioritize mitigating risk as a way to best manage the “limited time and energy and resources” within the security team, Brickhouse said.
• Keeping visibility continuous, Brickhouse added, since taking inventory of an environment today, “doesn’t mean that’s what it looks like tomorrow.”
• Enterprises should also look at “organizational readiness,” which includes preparing the workforce within an enterprise for any individual-facing attacks, Santos said.