industry standards for organizational network defense
For every digital asset a company has there is someone who is looking for a way to exploit a weakness to gain access to it. Trade secrets, customer information and third-party partner databases are all targets in which cyber criminals and competitors are all constantly trying to find in order to gain a competitive edge or damage the financial and or public reputation of companies that do business on the internet. Direct harm is not always the motive but any network access that is not authorized should be considered malicious and with the intent to disrupt business operations or steal something that will hurt the organization. These threats are just as real coming from the outside as they are on the inside. Negligence from employees can sometimes be just as damaging as a direct attack from external threat actors and most times is the reason for the attack being successful. Social engineering is the most effective way hackers gain access to information and usually is the most difficult threat to fight against. Companies must learn to protect themselves from the attackers on the outside and the negligent and disenfranchised employees on the inside. When doing business primarily in cyberspace, organizations become very big targets. And there is almost always more enemies attacking the fort than there are soldiers able to defend it. That is why it is so imperative that network defense and pre-emptive strikes be front and center in the organizations plan to keep themselves safe and protected from all the possible breaches that exist.
This paper discusses the industry standards for organizational network defense and how and when the lines get blurred when it comes to what is legal and or ethical. When is it okay to go on the offensive, what does that mean and how far should and can organizations go to defend themselves?
We will discuss the responsibility of management and the need for shareholders buy in as well as all the individual stakeholders inside and outside the organization. Cyber warfare does not just encompass nation states and militaries. Organizations both big and small, public and private have become large targets and it is becoming more and more critical that they be able to not only defend themselves from inevitable breaches and attacks but use tactics that will prevent and deter cyber criminals from gaining access to assets that could cause irreversible financial and operational damage.