The most exciting part of my job occurs when I have the opportunity to visit with a new client organization and help its leaders assess their security infrastructure and remediate any vulnerabilities. I enjoy being able to examine the current state of their cybersecurity programs and help them redesign elements to better address the modern threat environment.

Recently, I had the opportunity to engage in this type of work with one of CDW’s customers — the government of a midsized county. As we worked through the assessment, we identified two core issues that required immediate attention. First, the county’s network firewall platform was quite outdated, running technology that was over a decade old. The devices still functioned, but they were designed to protect against the threats of 10 years ago, not today’s advanced persistent threats. Our first core recommendation was that the county replace this aging firewall infrastructure with a modern next-generation firewall (NGFW) designed to stymie today’s attackers.

We also realized that the core of the county’s network lacked essential security controls. If someone gained physical access to the building and connected any device to the network, the attacker would have open access to all types of resources. There was no internal access control restricting the devices that could connect to the network and limiting the authorization of those devices based on the identity of the user. The county urgently needed a network access control (NAC) solution to address these risks and protect its network.

A lot of attention gets paid in the press to “zero-day” threats — attacks that wreak havoc on organizations while they’re still completely unknown to the cybersecurity community. But the truth is that 60 percent of breaches are the result of known vulnerabilities that have been left unpatched.

The problem is that patching practices in many organizations are slow and disorganized. Too many teams are in charge of patching too many different systems, and security leaders typically lack visibility into who is staying on top of patching and who isn’t. The good news is that many organizations already have a powerful tool to help streamline vulnerability management — the service management platform ServiceNow. Although some organizations use the platform primarily to manage help desk tickets, it’s capable of much more. The solution can also help organizations shore up vulnerabilities across their IT environments.

Here’s how.

I have a unique perspective on healthcare cybersecurity, having spent the beginning of my professional career as a practicing nurse and later moving into cybersecurity consulting. That perspective helps me critically examine the security programs at the many hospitals, physicians and other provider offices that I visit as part of my CDW practice. During conversations with healthcare IT teams, I’ve identified three crucial best practices to protect patient information: vulnerability assessments, penetration tests and incident response playbooks.

Let’s explore each of these critical topics.

Vulnerability scanning, penetration testing and red teaming each play a vital role in an organization’s security program. It’s important that technology leaders understand the different roles they play so they may combine them in the manner most effective for their organizations.

Last year, I consulted with a pastor whose church had suffered a ransomware attack. This particular church had an extensive fundraising operation designed to support a local homeless program, and the ransomware infection impacted all of the data used to solicit donations — and ground those important efforts to a halt.

Like many nonprofits, the church fallen into a common trap: the fallacy of thinking that they don’t have any important data that would attract attackers. But, in this world, every organization is a potentially lucrative target.

With the rise of ransomware attacks against organizations of all sizes, cybersecurity has become a top priority for even small businesses. Unfortunately, the unique challenges of a smaller organization can make securing the IT environment particularly difficult. IT staffs are typically stretched thin and asked to be knowledgeable across a variety of domains. Additionally, allocating…