In its November 2016 report, “Ransomware Protection Best Practices,” Forrester Research offers clear and compelling advice, beginning in the document’s subtitle. “Harden Your Defenses Now For This Growing Threat.”

In a companion blog post, Effective Ransomware Protection: First, Fight Your Fires, I highlighted Forrester’s recommendations for putting out the cybersecurity fires already burning (or about to burn) at your enterprise. This time out: my take on Forrester’s recommendations for what to do once those initial fires are under control.

What “fireproof” means

Note, please, that “fireproof” does not necessarily or exclusively mean “cannot be burned.” Instead, a fireproof enterprise can resist and minimize the effects of fire. Similarly, no cybersecurity can prevent every attack from succeeding. But effective cybersecurity quickly quarantines and kills threats that get through, and remediates any effects on data, systems, and users.

What to do next—and how to do It

Forrester uses clear, direct language to map out the route from fire-fighting to fireproofing. All you need is “a focus on the core needs required for defending your environment against targeted attacks so that you can lay a foundation for a resilient security strategy.”

No pressure. Nothing complicated. So to help further, Forrester also lays out six more specific needs.

  1. An actual security strategy.
  2. A dedication to recruiting and retaining staff.
  3. A focus on the fundamentals.
  4. An integrated portfolio that enables orchestration.
  5. Prevention.
  6. Detection and response.

Forrester adds that addressing the first four of these needs is a prerequisite for success with the remaining two. A focus on prevention, detection, and response also aligns closely with the “top five” Center for Internet Security (CIS) Critical Security Controls (CSC) for Effective Cyber Defense.

  • CSC 1: Inventory of Authorized and Unauthorized Devices
  • CSC 2: inventory of Authorized and Unauthorized Software
  • CSC 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
  • CSC 4: Continuous Vulnerability Assessment and Remediation
  • CSC 5: Controlled Use of Administrative Privileges

The CIS Controls reference and are referenced by many of the world’s leading cybersecurity frameworks and recommendations Examples include cybersecurity guidance from the US National Institute of Standards and Technology (NIST), the United Kingdom (UK)’s National Cyber Security Centre (NCSC), and the Australian Signals Directorate (ASD). Why? Because the CIS Controls work. “Organizations that apply just the first five CIS Controls can reduce their risk of cyberattack by around 85 percent,” the CIS says at its website.

Ivanti: Your fireproofing partner

Ivanti can help you transform Forrester’s recommendations and the top five CIS Controls into actual, effective protections against ransomware and other malware, automating and simplifying prevention, detection, and remediation. Capabilities such as discovery, patch management, application and device control, and administrative privilege management—essential elements of the Top Five CIS Controls—power Ivanti’s solutions. What’s more, Ivanti helps customers implement those Controls successfully, economically, and easily, with minimal impact on user productivity.

Make sure to download the Forrester report for the details of their recommendations, both short- and long-term. Then, check out our anti-ransomware/malware solutions online, or contact Ivanti to learn more. Together, we can help you to put out your immediate cybersecurity fires, and to make your enterprise more fireproof.

Layered security is the whole endpoint