If you’re anything like me, you were probably roped into joining yet ONE more fantasy football league with new players to follow while monitoring injuries and the waiver wire. There truly is nothing like the stress of making changes to your lineup at the last minute before games kick off on Sunday morning!
So in honor of the 2022 NFL football season kicking off, why not not end the draft season with one last set of picks.
For this draft, I won’t be picking a fake football team. Instead, I thought I would draft my “fantasy security top picks” to make sure my team (or Startup organization) will be resilient every week of the season.
First Pick - Running Backs (Access Controls)
With my very first pick in the draft, I have to pick access controls. Just like the running back is the bedrock of any good fantasy football team, access controls are the foundation of a robust security system. Jonathan Taylor, Christian McCaffrey, or Austin Eckler should score you a solid 15-20 points every week, exactly like solid access controls will ensure that no one inside or outside of your organization can access your customer’s data. Many cyber-attacks are the result of faulty access provisioning and removal, weak password settings, or lack of oversight of employees. Access controls and reviews help you ensure that the people closest to your data are only working with data they should be, are properly authenticated based on conditional access, and are restricted from excessive access.
Second Pick - Quarterback (Vulnerability Management)
Like a good QB knows the playbook like the back of their hand, vulnerability management tools (with your permission) know and understand all aspects of your infrastructure, API, network, and code (your application’s playbook). Vulnerability management tools put your application to the test and can alert you where we might need to “call out a new blocking scheme for the offensive line,” or in the security world, remediate vulnerable areas within your environment.
Third Pick - Wide Receivers (Incident Response)
Wide receivers can always be hit or miss. The best receivers will always score a minimum of 10 points while also possessing the ability to pop off for 30+ points on a good day! Similar to wide receivers, the best incident response programs can “pop off” in crisis mode and “score” major points through fast actions to identify, isolate, and remediate any incident that might arise.
Fourth Pick - Tight End (Key Management & Cryptography)
You can always rely on a trusty tight end just like you can rely on good encryption and secret management to protect your data whether at rest or in transit. Every once and a while, your tight end might have a HUGE game when you least expect it by scoring 2 touchdowns. Encryption and solid key management might save the day and “score 2 touchdowns” by preventing malicious actors from ever making your data accessible, understandable, and readable.
Fifth Pick - Defense / Special Teams (Mobile Device Management)
A defense might not ever win you a fantasy football game, but it sure can lose you one with a bad performance. Mobile device management (MDM) is similar because poor MDM controls can lead to your organization’s data falling into the wrong hands, with no way to lock out or wipe a device. Solid MDM programs allow administrators to closely manage and monitor how employees are keeping their devices up to date and in line with company policies, and enable swift actions to protect data if a device is stolen and or lost.
Sixth Pick - Kicker (Third Party Management)
Comparable to hoping your kicker might score 15 points late in a Sunday game to help you beat your opponent, solid third-party management can always save the day if a vendor “goes rogue” or is subject to a data breach. Organizations with solid third-party management reviews and vetting are less likely to fall victim to data breaches from vendors by selecting secure partners and implementing great controls around what data those partners are receiving.
Thus concludes my fantasy security draft for 2022! Although there will no doubt be free agents out there ready to pick up, such as Threat Hunting or secure Logging and Monitoring practices, I believe my security team will run the table and keep my Startup secure throughout the season. May the fantasy gods be in your favor!