Cybersecurity Awareness Month: The Security Basics Organizations Need to Practice Year-Round
Summary
The article links recurring breach risks to gaps in basic security controls and recommends year-round practices for identity, patching, cloud configuration, runtime detection, logging, supply chains, governance, and incident response.
Key points
- The article cites breach reports showing persistent risks from social engineering, vulnerability exploitation, human involvement, and third-party exposure.
- It recommends MFA for privileged accounts, least privilege, short-lived credentials, scheduled access reviews, and monitoring for unusual identity behavior.
- It advises prioritizing patches by exploitability and exposure, tracking remediation, scanning dependencies and workloads, and maintaining an accurate software inventory.
- Cloud and Kubernetes guidance includes continuous configuration checks, limiting network and storage exposure, and tightly scoped permissions and container privileges.
- For detection and response, it recommends runtime sensors, monitoring for workload drift, tuned alerts, centralized audit logs, and tested containment playbooks.
- The article also calls for supply-chain controls, clear ownership of security policies, practical social-engineering training, and rehearsed incident response.
Article Details
- Defense Focus
- Consistent implementation of foundational security controls across identity, vulnerability management, cloud and Kubernetes configuration, runtime detection, logging, supply chain, governance, and incident response.
- Detection Methods
- Monitor identities at runtime for unusual actions, locations, and times, including activity performed with valid credentials.
- Continuously scan cloud accounts and configurations for posture drift.
- Deploy runtime sensors across workloads and detect containers running binaries absent from their original images.
- Establish behavior baselines to tune alerts and reduce false positives.
- Correlate identity and runtime anomalies across the same workload.
- Continuously scan running workloads, software images, dependencies, and container base images.
- Data Sources
- Cloud, container, and identity logs
- Audit logs
- Runtime workload activity
- Identity and access activity
- Software inventory and SBOM data
- Container images and dependency inventories
- Cloud configuration and posture data
- Platforms
- Cloud environments
- Kubernetes
- CI/CD pipelines
- Defensive Actions
- Enforce MFA for all human accounts with elevated privileges.
- Use short-lived credentials and workload identities instead of long-lived service-account keys; rotate credentials and API keys regularly and after personnel changes or third-party offboarding.
- Apply least privilege, regularly review and revoke access, and automatically expire temporary access.
- Prioritize patching by exploitability and exposure, track remediation time, and maintain an accurate software inventory.
- Continuously scan images, dependencies, and running workloads before and after deployment.
- Run continuous cloud posture checks; restrict public storage exposure, close unused ports, tighten security groups and firewall rules, and apply Kubernetes network policies.
- Scope Kubernetes RBAC to least privilege and restrict pod privilege escalation, hostPath mounts, and privileged containers.
- Centralize and enable audit logging across cloud, container, and identity layers; retain logs long enough for investigations.
- Prepare and test containment actions and incident response procedures for high-confidence alerts.
- Vet and monitor third-party access, protect CI/CD credentials and permissions, and sign and verify pipeline artifacts.
- Define ownership and expiration dates for security exceptions, govern approved AI tools, and train personnel on current social-engineering methods.
Products
NIST AI Risk Management FrameworkAnchor to established frameworks. For example, use NIST AI RMF for AI risk and the OWASP Top 10 for LLM Applications works as a complementary threat checklist.OWASP Top 10 for LLM ApplicationsAnchor to established frameworks. For example, use NIST AI RMF for AI risk and the OWASP Top 10 for LLM Applications works as a complementary threat checklist.
Industries
communicationsa single hour of downtime costs over $100,000, with industries like finance, healthcare, media, and communications reaching well over $5 million per hour. That means a critical service outage spanning the length offinanceSurvey, for large enterprises, a single hour of downtime costs over $100,000, with industries like finance, healthcare, media, and communications reaching well over $5 million per hour. That means a criticalHealthcarefor large enterprises, a single hour of downtime costs over $100,000, with industries like finance, healthcare, media, and communications reaching well over $5 million per hour. That means a critical service outageMediaenterprises, a single hour of downtime costs over $100,000, with industries like finance, healthcare, media, and communications reaching well over $5 million per hour. That means a critical service outage spanning