CISO outlines three security fundamentals for resource-strapped mid-market IT leaders

Kevin Charest, CISO and VP of Cyber Governance Services, identifies three critical steps for mid-market IT leaders to strengthen their organizations' security posture. According to Security Magazine, these steps address the unique challenges faced by smaller entities that lack the extensive resources of large global enterprises.

Charest notes that understaffed IT teams often attempt to stitch together fragmented security tools. This approach frequently leads to a reactive posture instead of a resilient one. He emphasizes that mid-market organizations face the same security threats as large global enterprises but operate with a fraction of the resources.

Strategic Fundamentals for SMBs

Charest advises mid-market IT leaders to focus on three specific fundamentals to bolster security. The first is establishing clear visibility across the entire environment. The second involves implementing outcome-driven security that aligns directly with regulatory requirements. The third requires creating a realistic plan to address unpatchable technical debt through compensating controls.

Cybersecurity can no longer be treated as a luxury line item for businesses of any size. Charest states that security determines how quickly an organization can withstand and recover from attacks. This capability is essential for protecting day-to-day operations. By establishing these fundamentals, IT leaders can treat cybersecurity as a business imperative despite resource limitations.

Challenges Facing Mid-Market Organizations

Small- and medium-sized businesses historically struggle to keep pace with adopting new technologies. Many instances of this lag are attributed to a lack of funding or staffing. Oftentimes, IT leaders serve as the security leaders in their organization without dedicated security teams.

Last year, cybersecurity was ranked among the highest business concerns for small- and medium-sized businesses. Without the resources of larger enterprises, it can be challenging to properly secure these organizations. The pressure to maintain security while managing limited budgets creates a difficult environment for IT professionals.

What should you do?

IT leaders in mid-market organizations should assess their current tool fragmentation and prioritize visibility. They must align security outcomes with specific regulatory requirements to ensure compliance. Additionally, teams should identify unpatchable technical debt and implement compensating controls to mitigate risks.

What to do and how to stay safe: SMBs

• Audit current security tools to identify fragmentation and improve overall visibility across the environment.
• Align security initiatives with specific regulatory requirements to ensure outcome-driven protection.
• Identify unpatchable technical debt and implement compensating controls to mitigate associated risks.
• Treat cybersecurity as a business imperative to improve resilience and recovery capabilities.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What are the three fundamentals Charest recommends for mid-market IT leaders?

He recommends clear visibility across the environment, outcome-driven security aligned to regulatory requirements, and a plan to address unpatchable technical debt through compensating controls.

Why do mid-market organizations struggle with cybersecurity?

They face the same threats as large enterprises but have a fraction of the resources, often relying on understaffed IT teams and fragmented tools.

How does Charest view the role of cybersecurity in business operations?

He states that cybersecurity determines how quickly an organization can withstand and recover from attacks to protect day-to-day operations.