How to implement a cybersecurity strategy

How do you implement a cybersecurity strategy? Start with a risk assessment of your assets and threats, then set security objectives and risk appetite, write security policies, close control gaps (identity, network, endpoint, data), develop recovery plans, run continuous monitoring, train staff, and review the strategy at least once per year.

Most organisations align these steps to a framework such as NIST CSF 2.0 or ISO 27001.

Steps in implementing a cyber security strategy

1. Start with a full security risk assessment

A security risk assessment is a structured review of your IT environment that identifies what you need to protect and the threats your environment faces. A security assessment evaluates your existing environment and identifies potential security gaps and risks that expose you to threats.

A comprehensive risk assessment covers:

• Assets and data: This includes an inventory of systems, applications, cloud services, and devices, and where sensitive or personal information is stored
• Threats and security vulnerabilities: This identifies known weaknesses, unpatched systems, and the most likely targets
• Existing controls: This examines how well your current policies, processes and tools are working
• Business impact: This estimates what cost in terms of downtime, revenue, and reputational damage a breach would have

For South African organisations, the security risk assessment should also show where personal information is processed, since POPIA requires that organisations safeguard that data.

Testing methods such as Penetration Testing help to confirm where the vulnerabilities are instead of relying on shaky assumptions. 

Risk assessments should be repeated annually and after major changes such as cloud migrations, acquisitions or severe threat incidents.

2. Define your organisation’s security objectives and needs

Cyber security strategies need to be developed with a focus on the security objectives and needs of the organisation and its relevant stakeholders. Security objectives are specific and measurable outcomes your strategy is designed to achieve. They should link directly to business priorities such as regulatory compliance, uptime and the protection of critical data. 

The findings from the security risk assessment should be used to prioritise the systems and data that matter most to your business. 

The risk appetite of the organisation must also be set. Risk is always present, so you need to prioritise which risks will be reduced,  transferred, or accepted

Objectives must be measurable and specific. "Improving security" is too vague. 

Better objectives are reducing downtime during incidents, aligning with recognised security frameworks, or implementing multi-factor authentication for all the organisation's users.

Clear ownership must be assigned to security responsibilities and responses. The strategy normally sits with a senior leader such as a CISO. 

Organisations without a dedicated CISO can make use of a Virtual CISO Service to provide strategic leadership without a full-time hire.

 

3. Develop or update security policies 

The performance of your security tech stack is only as good as the policies in place to use them and the management of the whole cybersecurity process from start to finish. Before writing those policies, you should choose a security framework to structure them. A framework provides a proven checklist of what to cover, reporting language, and benchmarks. 

Choose a framework
The three most widely recognised frameworks are:
 

• NIST Cybersecurity Framework (CSF) 2.0: This is an outcomes-based framework organised around 6 functions (Govern, Identify, Protect, Detect, Respond and Recover). This is useful for organisations that want a clear framework without the need for formal certifications.
• ISO/IEC 27001:2022: This framework is considered the international standard for IT security systems. It is a certifiable system which makes it easier to provide evidence of the organisation's security posture to stakeholders.
• CIS Critical Security Controls: This framework consists of 18 practical controls. This is most useful to mid-sized organisations that want practical and specific security guidance. 

These frameworks are not mutually exclusive, and organisations often use a combination of them. 

South African regulation

POPIA requires organisations to take reasonable steps to protect the personal information they hold and process. South African organisations must keep POPIA in mind when designing their policies. 

Image

4. Evaluate your security tool stack 

Knowing the capabilities and limitations of your current security technology stack will help you develop and implement an effective cyber strategy. This allows you to optimise the protection offered by these tools, and source new technologies where gaps exist. Use the framework you selected as your benchmark. Map each tool's function to see where tools overlap, where you're covered, and where gaps exist.

A good security tool review checks 5 areas
 

• Coverage: Do the tools protect every area identified by the risk assessment? 
• Overlap: Are some of your tools doing the same job?
• Integration: Do the tools speak to each other, or does your team have to switch between them?
• Usage: Are there features of the tools that are not being used? 
• Capacity: Does the security team have the time and people to respond to every alert from each tool?

Having too many tools creates a complex environment, which presents a new security risk. Existing tools should be audited and integrated where possible before new tools are sourced.
 

5. Set privileges and access controls

Strong access controls that work on the principle of least privilege should be implemented. Identity is one of the main targets for threat actors. They no longer have to break through firewalls when they can log in with stolen credentials. This makes access control a very important component of a cybersecurity strategy.

Apply the principle of least privilege everywhere

Limiting users only to what they need to use helps with preventing unnecessary risks and unauthorised applications from accessing sensitive business information. Access should only be given for specific roles or tasks and should be revoked once it is no longer required.

Access controls to implement

• MFA (Multi-factor authentication)
• Privileged access management: Separate admin credentials and time-limited access. Privileged activity is also logged
• Conditional access policies: Checks the user, device and location for risk before granting access
• Access reviews: Regular checks to remove redundant or outdated permissions

Image

6. Ensure that strong network, endpoint, email and data security measures are in place

Every connection, device and inbox can be a potential entry point for security threats. 

Network security

Network security measures include firewalls, encryption, and intrusion detection tools. You should also have visibility over everything moving through your networks. Segmenting your network allows you to limit the blast radius of threat incidents should they infiltrate your network. Zero Trust principles are very useful in securing your networks. No user, device, or connection is trusted by default; access is granted only after verification for specific requests.

Endpoint security

Endpoint security involves regular patching of devices, encryption, and endpoint detection and response (EDR) tools that monitor devices for suspicious behaviour. 

Email security

Email is a very common source of risk due to phishing, malware, and email compromise. Filters must be in place to stop malicious links and attachments. Organisations can also implement email authentication (SPF, DKIM and DMARC) to prevent impersonation of emails. 

Data security

Identify, classify, and encrypt all sensitive data. Data Loss Prevention (DLP) detects and blocks attempts at sharing data outside of the organisation.

7. Develop incident response and business continuity plans

Not all attacks can be prevented, so organisations need two synchronised plans. The incident response plan determines how the organisation detects, contains and recovers from an incident. A business continuity plan ensures that critical operations continue running while that is happening. 

Build an incident response plan

A comprehensive incident response plan should cover:
 

• Roles and responsibilities: Who leads the response, who makes shutdown decisions for systems, and who is the designated communications lead for any incident situations
• Response strategy: Preparation, detection, analysis, threat containment, eradication, recovery, and reviewing what was learnt 
• Incident response playbooks: This outlines the strategy for dealing with a wide range of security incidents
• Contact lists for internal teams 

Obligations for South African organisations

When personal data has been accessed or acquired by unauthorised people, then the organisation must notify the Information Regulator and the affected parties as soon as possible. This step must be included in any incident response plan.

Protect and test backups

Regular backups allow business continuity in the event of a breach or incident. Attackers do target backups, so it is important to have at least one offline copy stored in a separate location that cannot be accessed by threat actors. 

8. Ongoing monitoring and response

Whether the organisation has an internal security team or outsources IT security to a Managed Security Services Provider (MSSP), the task of monitoring and responding to security threats never goes away.

How ongoing monitoring works

Monitoring is usually run from a SOC (Security Operations Centre). A SOC is a team of security analysts who monitor the organisation's environment, investigate alerts, and respond to threats. 

Through the use of Security Information and Event Management (SIEM) tools, network and system activity is monitored for threats or unusual activities.SIEM collects logs from across the organisation's environment and flags potential risks or attacks. 

Extended detection and response (XDR) correlates signals from endpoints, emails, identities, networks and cloud environments in one dashboard so that analysts can view and respond to threats faster. 

In-house or managed services?

Implementing a 24/7 SOC in-house requires a team of specialised staff with rare skill sets, which makes it difficult for many organisations to achieve. Managed services give organisations access to monitoring and response capabilities without having to build it internally. 

9. Creating cyber security awareness in the organisation

Training and giving employees an appreciation of the many security threats they face in their daily jobs will help to prevent many security breaches. Employees must know how to spot and deal with security threats such as phishing and ransomware.

Threat actors are using AI to create complex and convincing attacks that can impersonate the C-suite and write convincing emails free of the traditional errors that made them easy to detect. Training needs to be up to date to equip staff to recognise and safeguard against these new threats.

Training should be regular and relevant. This can include:

• Short sessions regularly instead of one annual course
• Role-specific training (e.g. finance teams who deal with payments and are targeted by phishing attacks)
• Security onboarding for new employees
• Robust verification processes for payments or sensitive data transfers

Organisations can make use of simulated phishing email campaigns to test how alert their employees are. You can measure how many clicked on phishing links and how many flagged and reported it. 

Reporting threats should be encouraged in an organisation and not punished.
 

10. Review, audit and update

Regular reviews of security processes, tools, people and policies help to keep business security systems up-to-date and responsive. A cybersecurity strategy isn't applied once and then forgotten. Threats, the business context, and controls all change over time. 

When to do a review of the cybersecurity strategy

It should be reviewed annually. Each review begins with a risk assessment which starts the process again. 

Measure what matters

The organisation should track metrics that correspond to the security objectives it has set:

• % of users protected by MFA
• Time taken to patch vulnerable systems or tools
• Phishing campaign simulation response and reports
• Success rate of backup restores 
• Time taken from detection to containment of threats

Audit the strategy and test it regularly 

It is necessary to get objective reviews from independent providers to get the full picture of the organisation's security posture and cybersecurity strategy.

Many organisations are moving from annual penetration tests to continuous testing. This helps them detect vulnerabilities much faster as their environment changes. 

Learn from incident events

Each incident, breach, and vulnerability is a potential lesson that can be used to feed useful data back into the organisation's policies and strategy. 

Image

Where to start with your cybersecurity strategy

Implementing an effective cybersecurity strategy is an ongoing process. You need to assess risks, set objectives, align to recognised frameworks, close gaps in the control mechanisms, prepare for incidents, monitor, train employees, and review the strategy.

The first step is the most difficult one, as you need a clear view of your current security posture, and it's difficult to know where to focus budget and time.

Logicalis South Africa is an accredited managed security services provider (MSSP) with a SOC (Security Operations Centre) that monitors and protects our customers' data 24/7. 

Through our Intelligent Security portfolio, we help organisations assess their risks, build cybersecurity strategies, and manage them on an ongoing basis.