The DDoS (Distributed Denial-of-Service) attack on X this month again highlights the crucial nature of having a consistent roll out of cyber controls across an estate.  

Initial reports have suggested that not all of X server estate was properly secured behind Cloudflare’s DDOS Protection Service.  

The nature of these DDoS protection services has mitigated the frequency of DDoS attacks we have seen in recent years but is still reliant on being configured correctly across the entirety of an estate.  

Effective governance at a management level ensures that consistent controls are in place across the board, and as cringe worthy as it sounds, threat actor groups will continue to target the weakest link in the chain and choosing the path of least resistance.  

Governance can take the form of a BIA (business impact analysis) an exercise that highlights risks to the business, and the application of mitigating controls to reduce the level of risk from a likelihood and impact perspective. This includes a level of threat modelling, essentially asking what could happen to this asset, what would the result be to the business if this was to happen.  

Having a complete and formalised asset inventory can support this effort, this is essentially a list of everything you have, what it is and where it sits. This is the sort of document that would have supported X with showing the number of external facing servers it has currently. This in turn would have been used for the application of the Cloudflare service.  

Assurance is the marking of the homework; are the controls being applied in the way management intended?  Independence from the rest of the business is useful here as they are not subject to internal policies and roadblocks. These assurance activities should check the roll out but also, if possible, the configuration. This is driven from policies, what we should be doing, but also standards how we should be doing it. It is this checking of the consistency that will drive maturity.  

The above activities are all part of a wider information security management system that an organisation should look to adopt to manage their information security effectively to reduce the risk of a cyber event occurring.