How FSOs Can Manage Cybersecurity

While Facility Security Officers (FSOs) aren’t traditionally responsible for managing an organization’s cybersecurity program, their role in protecting national security information and overseeing facility access control systems often puts them in line with the duties of a Chief Information Security Officer (CISO). Managing facility and cybersecurity have become blended today as cyber-attacks become more sophisticated and organizational security resources are aligned.   

Furthermore, recent global events including the Russia-Ukraine War yielded a 16% increase in worldwide cyber-attacks within just the first month after it started. That number has and will only continue to rise — putting our government and its defense contractors at even greater risk than before and adding additional concerns to those in facility security positions. 

FSOs are not usually tasked with constructing and implementing a full-scale cybersecurity program. However, they are responsible for some of the physical security aspects of a strategy and what goes into detecting and mitigating insider threats. Therefore, FSOs should be well-versed in cybersecurity regarding today’s risks, potential solutions, and what they can do to help their firm overall. 

With all of that said, here are some ways FSOs can effectively take part in managing their organizational cybersecurity. 

Enhance Your Cyber Literacy

Individually speaking, one of the best ways for an FSO to prepare for a cyber-related incident is knowledge. Keep up-to-date on the latest threats, trends, and solutions to give yourself a comprehensive understanding of how the cybersecurity world operates and how it can affect facility security. 

While general cybersecurity knowledge is essential, you’ll also want to focus much of your attention on the evolving insider threats. Learn about some of the methods malicious actors will use on the inside to gain access and distribute sensitive information to foreign adversaries and other threats to our national security. 

Much of your knowledge can be obtained by the FSO toolkit. Provided by the Center for Development of Security Excellence, the FSO toolkit is a centralized library of resources that FSOs can utilize to perform their job effectively. In addition to training modules and clearance information, there are plenty of documents, videos, and materials related to safeguarding resources and managing threats within cyberspace.  

Collaborate with Cybersecurity Leadership

Coordinating with interrelated departments for security purposes cannot be emphasized enough. FSOs need to make an organized effort to work with CISOs, CIOs, CTOs, IT directors, and any other similar positions responsible for managing IT assets and cybersecurity strategies. So how might this collaborative effort look?

Share Data & Insights 

Starting at the top, FSOs and IT security leaders should be sharing memos, reports, and analyses of what they are seeing. This includes anomalous events, impact reports, penetration testing results, vulnerability assessments, and any other valuable information to the facility security and cybersecurity teams to improve their overall posture and system visibility. 

Create a Synchronized Security Culture 

Building working relationships and sharing security insights across different departments helps build an organizational culture that takes security seriously. Additionally, collaborating on goal-setting, strategy development, and resource allocation will keep the various departments in sync with one another — improving communication and executing a strategic vision.  

Coordinate on Compliance Changes 

For defense contractors, a widespread challenge shared amongst cybersecurity and facility security teams is meeting compliance demands. These requirements are often rigorous, constantly changing, and can overlap between different security functions. That being said, it’s important to work as one cohesive unit across departments to ensure a smooth transition into the new elements of the regulatory or certification requirements.   

Provide Security Awareness Training

Similar to how FSOs need to become literate in the cybersecurity discipline, awareness training should be provided to employees and contractors of your organization. On top of the facility security basics covered in their certification training, personnel should be required to undergo training on hot cybersecurity topics. At a minimum, the covered subjects should include the following:  

Detecting Phishing Scams 

Since most cyber incidents are sourced at phishing attacks, teach your employees the basics of phishing scams, the different types (spear phishing, whaling, etc.), what they commonly look like, and how to avoid them. Ensure this training is supplemented with phishing penetration testing to see if they grasped the material in a simulated environment.   

Password and Credential Management  

Teach employees the basics of constructing and securely storing passwords to help prevent password-based attacks such as keystroke logging or brute force algorithms. Also, give them the knowledge to properly manage their physical and biometric credentials they’ll need to access secure facilities and sensitive locations.   

Emerging Threats

Facility security management personnel should be updated on today’s threat actors, commonly used tactics, and the impact of foreign influence on cyber attacks. Furthermore, they should go over the importance of preparing for supply chain attacks and the best ways to detect insider threats and prevent them from becoming successful.  

Security Controls and Processes 

Employees should be equipped with controls to prevent, detect, and respond to cyber incidents and understand how to use them to their fullest capabilities. You also want to ensure that every member of the industrial security department is aware of their specific role in the event of a successful cyber attack per the organization’s incident response plan. 

Utilize Secure and Compliant-Ready Technology 

Keep in mind that many of the compliance requirements set forth for defense contractors offer a framework for how to construct certain processes for security purposes. Those requirements include the technology and software systems that need to be used to manage personnel, premise visitors, and, yes — cybersecurity. 

FSOs can help themselves by investing in software platforms that support all requirements from the Department of Defense (DoD) for Controlled Unclassified Information (CUI), the Defense Federal Acquisition Regulation Supplement (DFARS), and much more. Your technology resources should comply and help you manage governance and oversight. 

Sophisticated reporting features, for instance, can help FSOs easily prepare for their next audit. Additionally, you want a platform that synchronizes with the Defense Information Security System (DISS) and supports the NIST 800-53 for managing security and privacy controls and the Cybersecurity Model Maturity Certification (CMMC) for DoD compliance in safeguarding national security information.    

Stay Ahead of Cyber Threats with MathCraft Security Technologies 

The merging of cybersecurity and facility security management has evolved into a holistic organizational function that requires collaboration between various departments. FSOs, now more than ever, must be knowledgeable in the cyber threat landscape and solutions to protect sensitive data in their control. 

Contact us today to learn how you can enhance your industrial security and ultimately improve your cybersecurity posture. Our integrative solutions can help you manage your facility security strategies to stay compliant and organized, empower employees with self-service tools, and have complete control over your visitor processes from check-in to check-out.