Companies with a focus on cyber hygiene and security basics prevent more attacks and find intrusions faster.
In 2020, nation-state attackers compromised as many as 18,000 companies by inserting malware into an update from remote management vendor SolarWinds. Early this year, as many as 30,000 organizations suffered an attack through zero-day vulnerabilities in Microsoft Exchange.
These attacks may leave security teams feeling they must focus on preventing—or at least preparing for—the most sophisticated attacks, such as supply chain breaches or zero-day vulnerabilities. However, cyber hygiene and consistently stressing security basics remain the most important practices for companies, boosting their ability to detect attackers who get inside their networks and systems.
“I would contend that about 95 percent of the exploits that are used by nation-state actors and high-end criminal groups are not using zero days but just [exploiting victims who leave] the doors open for the attackers,” says Gregory Touhill, a director on the board of the Information Systems Audit and Control Association (ISACA) and a professor of cybersecurity at Carnegie Mellon University. He argues that closing the front door to the network by patching and applying good configuration management and other measures will have the greatest long-term impact. Why would attackers use high-value attack techniques when they can just walk in the unlocked back door?
The stats bear this out. Companies with leading cybersecurity programs are four times better at stopping attacks and finding breaches, three times better at responding to breaches, and two times better at reducing the impact of a breach, according to Accenture’s State of Cyber Resilience report.
“You want complete visibility and consistency, developing the right operating model for network and endpoint, and, for access, understanding how to use least privilege to lock down the cloud services and network components,” says Rob Boyce, North America cyberdefense lead at Accenture Security.
Sophisticated and large-scale attacks will always stand out, but boring, day-to-day security measures are key to minimizing risks. Here are the basics, broken down into three typical categories: people, process, and technology.
People: Principles, awareness, strong passwords
As employees have shifted to remote work, educating them in strong security principles has become even more important. While many security teams think of employees as a source of vulnerability, when trained well, they can be the first line of defense.
Teaching employees about best practices—use a password manager, do not reuse passwords, use multifactor authentication, and be suspicious of email—goes a long way toward keeping your company safe. Show your people concrete examples of what damage can happen by failing to put these practices to use and they’ll be more likely to get on board.
How big a team do you need? The typical company dedicates two full-time employees to attain the average level of security awareness: promoting awareness and behavioural change, according to the SANS Institute’s 2019 Security Awareness Report. To achieve an above-average level, the equivalent of more than three full-time employees are necessary depending on the size of the company. (The survey focused on companies with at least 1,000 employees.)
The companies most secure in their management of security measure their progress closely and track employee training and practices. A good place to start is to use the results of phishing drills. When Touhill—then Brigadier General Touhill—served as CIO of the U.S. Transportation Command, he conducted regular phishing drills and publicized the results.
“We started out with a 17 percent click rate, and then we would point out what was wrong with the message, and pretty soon we got down to less than [one] percent,” he says. “We also publicized the results—anonymizing the soldiers—so it became sort of a competition.”
Process: Protect assets, financial transactions, data
To secure your organization, you need to know what assets are critical and how to best protect them. Maintaining an up-to-date census of assets is a critical basic security function for companies. Only when companies know all of their assets can they keep them patched and determine the appropriate controls for each category of asset.
“If you don’t know what assets you have, where those assets reside, the criticality of those assets, how can you fundamentally add additional layers of control to secure those systems and data?” says Andrew Rafla, principal and lead for zero trust at Deloitte Risk & Financial Advisory.
With the rise of various forms of invoice fraud—from business email compromise (BEC) to spear-phishing attacks that target the finance department—creating a robust accounting and payment process in conjunction with a firm’s bank is incredibly important. Often, business email fraud starts with the compromise of an executive’s account, which is then used to forward invoices and bank transfer details.
To protect against the increasingly sophisticated BEC schemes, invoices should be verified using a variety of checks through different points of contact to minimize the potential for fraud.
Another damaging scheme is ransomware attacks, especially the more recent variant known as double extortion, in which data is stolen and then encrypted. Companies that do not pay the ransom demand not only do not get the key to unlock their data but will likely find their data published to the Internet.
The first line of protection for companies is to back up the most important data and run regular exercises to verify restoration. The restoration process has to be as painless as possible. There are cases where companies have paid ransoms even when they have backups because the act of restoring data takes too much time.
Unleash Your Inner Tech-Titan
Where IT Doesn’t Just Work, It Transforms.
Let’s be real: IT challenges are getting tougher than a two-dollar steak. At X10 Technologies, we’re the national systems integrator who walks into that complexity and says, “Hold our coffee.”
We are the trusted advisors for organizations who want to operate not just securely, but ahead of the curve. Our secret sauce? A relentless focus on cybersecurity, infrastructure, cloud, and managed services, delivering outcome driven solutions that actually make a difference.
We don’t do short-term flings; we build long-term partnerships anchored in technical mastery. If you’re looking for a place that doesn’t just deliver solutions but actively powers transformation, welcome home.
Role Overview
Your Mission, Should You Choose to Accept it (Spoiler: You Should)
Are you ready to be the growth catalyst for X10 in British Columbia? Think of yourself as the highly caffeinated, strategically brilliant engine driving our market expansion.
As our Account Executive, you won’t just be “selling stuff.” You’ll be the person opening doors that matter, forging strategic relationships that last, and bringing future forward technology solutions to life for clients who need them yesterday.
If you’re craving a seat at the table where strategy, technology, and opportunity don’t just meet, they collide in a shower of sparks, this is it.
We’re looking for someone who treats a cold call like a conversation with a future best friend.
Key Responsibilities
• Develop and grow a portfolio of assigned accounts through strategic planning, prospecting, and relationship management
• Build and maintain senior-level relationships with customer stakeholders, decision-makers, and influencers
• Understand customer challenges and align X10’s technology offerings to deliver measurable business outcomes
• Manage the full sales cycle from opportunity identification through to close, including contract negotiation and forecasting
• Collaborate with internal technical teams and vendor partners to architect winning solutions
• Represent X10 at industry events, trade shows, and partner engagements
• Achieve and exceed annual sales targets, contributing to overall company growth
• Maintain accurate pipeline and CRM data to support forecasting and reporting
• Stay informed on emerging technologies and industry trends relevant to client needs
Qualifications
• 10+ years of progressive sales experience in the IT industry, preferably with a manufacturer, Value-Added Reseller (VAR) or systems integrator
• Experience working with public sector clients (education, government, or healthcare) is preferred
• Proven track record of meeting or exceeding quota in a high-performance sales environment
• Deep understanding of enterprise technology solutions including networking, cybersecurity, cloud, and managed services
• Strong communication, negotiation, and presentation skills
• Self-starter with a high degree of initiative and accountability
• Ability to build and maintain trust-based, consultative relationships with clients and internal stakeholders
• Market-leading base salary complemented by commission earnings
• Prior experience in the industry is required, with a background working for a VAR or vendor.