I’ve been put in charge of security and I have no idea what I’m doing.

Navigating the Uncharted Waters of Cybersecurity Management

Starting a new job can be both exciting and overwhelming, especially when you find yourself thrust into a role that you weren’t specifically prepared for. Recently, I found myself in this very situation when I was assigned responsibility for managing cybersecurity at my new workplace. While my background includes helping with various tech-related tasks, I never anticipated that I would be overseeing such a critical domain without any prior experience.

As it stands, our organization lacks established cybersecurity protocols, and until now, no one had taken on this crucial role. Although I am eager to embrace this responsibility, I must admit that the challenge feels daunting. We are on the cusp of expanding our visibility and expect to attract more attention from potential clients and stakeholders. This makes it essential that we get our cybersecurity measures up to par before we consult with an expert.

The goal is to prepare the groundwork so when a professional does evaluate our systems, we won’t be left feeling embarrassed by our shortcomings. But where do I begin?

Here are a few steps I’m considering as I embark on this journey:

Conduct a Cybersecurity Assessment: Start by evaluating our current security posture. Identify what assets we have, the data we need to protect, and potential vulnerabilities. Understanding our starting point is crucial for making informed decisions.
Educate Myself: With a lack of formal training in cybersecurity, it’s essential that I invest time in self-education. There are plenty of free resources, online courses, and forums that can help build a foundational knowledge of security best practices, compliance protocols, and risks.
Implement Basic Security Measures: Even with limited knowledge, I can begin implementing essential security practices, such as regular Software updates, strong password policies, and employee training on recognizing phishing attempts. These basic steps can significantly enhance our security posture.
Develop a Cybersecurity Plan: I will work on drafting a preliminary plan that outlines our approach to cybersecurity, including incident response procedures, regular assessments, and the roles of team members in maintaining security.
Engage with the Team: Collaborating with my colleagues can provide invaluable insights. Gathering feedback on existing processes and discussing concerns can help cultivate a culture of security awareness within the organization.
Prepare for the Consultant: As we look to bring in a security consultant, I’ll ensure that we have gathered relevant data about our current practices and documented our initiatives. This preparation will demonstrate