Your stakeholder dismisses network security updates. How will you convince them of the risks?

Explain how network security breaches can lead to downtime, impacting productivity and customer service. Focus legal and regulatory requirements for maintaining up-to-date network security. Non-compliance can result in hefty fines and legal action. Try to share case studies that suffered financial and reputational damage due to security breaches that could have been prevented with timely updates. Try to share past incidents within industry to make the risks more relatable. Perform cost benefit analysis, data on the average cost of a security breach.

The Colonial Pipeline breach in 2021 would be a good example: poor network security posture allowed an attacker to move laterally within the network, using compromised user credentials (no MFA was enabled on the account). MFA would have prevented initial access, good network segmentation would have prevented lateral movement. Network security monitoring was also lacking. Isolated network security misconfigurations on their own do not pose a high risk. When poor network security is combined with poor vulnerability management or simple misconfigurations in authentication and authorization is the issue. Usually poor network security doesn't come alone, it's accompanied by other issues as per given example of the Colonial Pipeline breach.

To convince stakeholders of the importance of network security updates: 1. Present Data: Show statistics on the rising frequency and cost of cyber-attacks. 2. Real-World Examples: Share case studies of companies that suffered due to neglected updates. 3. Highlight Compliance: Explain regulatory requirements and potential fines for non-compliance. 4. Cost-Benefit Analysis: Compare the low cost of updates with the high cost of a breach. 5. Expert Opinions: Bring in cybersecurity experts to support your points. 6. Risk Assessment: Conduct a risk assessment to demonstrate specific vulnerabilities and their potential impact.

Depending on the organization, there may be several regulatory requirements and standards mandating network security controls, such as PCI DSS, HIPAA, DORA, and others. Non-compliance can lead to significant fines, penalties, and regulatory action. In the event of a personal data breach, if the company operates in the EU, a GDPR fine may also be issued. For example, in October 2020, British Airways was fined ￡20 million (approximately €22 million) for a data breach that occurred in 2018, which exposed the personal and payment card information of over 400,000 customers. The attackers were able to move laterally within their network due to poor security measures, including weak access controls and the lack of multi-factor authentication.

Reputation can be at risk due to neglecting network security updates. Highlight that neglecting updates can lead to breaches, which damage trust and tarnish the organization's image. Use real-world examples of companies suffering financial loss and public backlash due to security lapses. Explain how customers and partners value security, and breaches can lead to lost business and legal consequences. Stress that maintaining a robust security posture through regular updates is crucial for preserving the company's reputation and ensuring long-term success. Effective security measures signal reliability and responsibility to all stakeholders.