Virtual CISO Gives Fortune-10 Support to Smaller Businesses

With malware and ransomware attacks tripling from Q2 to Q3, companies are hiring Chief Information Security Officers (CISOs) left and right, and are seriously re-examining their cybersecurity strategies for 2018. It is impossible for companies or consumers to ignore the exponential growth of damaging cyberattacks. Businesses hoping to avoid being the next Equifax are scrambling to bolster their cybersecurity programs, and spending on cybersecurity is predicted to reach $93 billion in 2018. Much of this spending will be from large business with designated CISOs and security teams. However, small and mid-sized business make up more than half of the US economy, yet they are far less-equipped to absorb the financial impact of a data breach. Their security approach is often cobbled together from various softwares and security appliances, and lacks any threat analysis or incident response strategy. It is critical for companies to have a clear understanding of their network and its vulnerabilities, and to have a security roadmap so that they can make informed, risk-based decisions. Virtual CISOs provide an easy and effective solution for businesses looking to increase their security without adding a whole new department.


With so many new tech roles popping up in C-suites, it can be hard to keep track of who does what. Many CEOs assume that their CIO will handle everything computer and network related- including security. However, the CIO and CISO roles are actually very different, and frequently at odds. CIOs and standard IT departments focus on network speed and ease of use. Their goal is to make everything run smoothly, which can sometimes mean delaying important program updates or loosening network restrictions. The CISO's role is to manage information security risks. They define and implement risk management frameworks, and ensure that sensitive data is only accessible to those who need it. They also develop incident response strategies, which are a major component of any effective security strategy. It is critical for companies to have both roles, and for CIOs and CISOs to have a good working relationship in order to make sure that networks are both efficient and secure.

The Importance of Designated Cybersecurity

Smart companies are implementing designated information security teams, with expert CISOs working to protect sensitive information and Intellectual Property from hackers and other cyber criminals. Restructuring budgets to address security concerns may not be a big deal for mega-corporations, but most small and mid-sized businesses do not have the budget for an in-house IT team, let alone a cybersecurity department. This can lead to huge gaps in companies' security processes. Many businesses with in-house IT support often delegate network security to their IT team. Though IT professionals may try to address security threats as part of their job, they are often overtasked, and security is usually a secondary concern to network speed and ease of access.  This often leads to poorly configured security software and hardware, creating serious vulnerabilities in the network.  A designated CISO will work with a company's IT department to make sure all security risks are considered when implementing or updating technology.

Network Monitoring and Incident Response

Even the most advanced network monitoring systems are vulnerable to malware and ransomware attacks, and if there is no one actively monitoring network activity it can be impossible to tell if threat actors are accessing your network. Many companies feel that once they have set up monitoring and antivirus software they are done. However, it is crucial to continually monitor your network for suspicious activity and to have an incident response plan in place in case of a cyberattack or data breach. An effective response plan is a crucial component of companies' cybersecurity strategies, and can help avoid the negative PR that can accompany a data breach. Developing an incident response plan is one of the core duties of a CISO, and often outside the scope of standard or third-party IT departments. Because of this, it is frequently omitted from security strategies. At Bluestone, we often see companies that have implemented sophisticated monitoring software, but didn't have a response plan in place, or even anyone on staff who is equipped to respond to an attack. By the time they detect a breach, hackers have been in their network for weeks or months, and downloaded or altered sensitive data.

A Virtual Solution

Bluestone offers a virtual CISO service that gives companies access to industry-leading cybersecurity analytics and intelligence. Our CTO, Joe DePlato, heads our virtual CISO program. Joe has worked as a senior cybersecurity consultant with Fortune-10 companies and acts as a virtual CISO for many of our clients. We work closely with you to analyze your needs and develop a security project roadmap, which will help your company make informed, risk-based decisions on security policies and improvements. Our vulnerability management program provides security roadmaps, cybersecurity training, and incident response. A virtual CISO gives advanced security solutions to small and mid-sized businesses without the hassles of developing an in-house security team. For more information about our virtual CISO services, schedule a consultation.