There is no doubt that today’s cyber security arena is dynamic, fast and under constant evolution — indeed, it is seemingly impossible to keep up with.

Every day, some breach or another is announced, the next world-ending vulnerability is discovered or the latest big data analytics solution is released that is going to solve everything. It is certainly exciting, but it also increases the risk of not being able to see the forest for the trees.

In the physical world our typical behaviours in how we secure ourselves easily translate into what we should be doing to secure ourselves virtually. Here are a few examples.

1. We protect our valuables first and foremost

In the office and at home, most of us tend to leave internal doors unlocked and/or enable easy access because we trust the people who are there. However, we don’t typically leave valuable jewellery on display, the car keys sitting on the windowsill or a stack of cash on the office desk overnight. We know it’s what criminals are most likely to be after, so we ensure they are as safe as possible.

Just like in the physical world, cybercriminals aren’t interested in the equivalent of low-value items in our gardens, halls, etc. They are after our crown jewels, such as customer data, account details and intellectual property. Crown jewel access should obviously be restricted only to those who need it, but access to these artefacts should also be specifically monitored for anything outside of “normal” behaviour or what business policies dictate.

There are always activities going on in areas of our networks that we would prefer not to happen, such as click-happy users and dubious app downloads. However, we need to focus our limited resources on what really matters and not put onerous and expensive security processes in place where the risk doesn’t warrant it and where it will not have too much of an impact on day-to-day business processes and life. It should not distract from the really significant security incidents that could affect the business.

2. We are more careful around people we don’t trust

When we are surrounded by people we trust, we tend to be less cautious. We don’t mind leaving our phone and wallet on the table and we talk openly. However, when in the presence of strangers or people we don’t trust, we are far more careful. We don’t leave items of value on display, and are far more aware of conversation so that we don’t reveal anything that can compromise anything valuable to us.

Similarly, in the virtual world, we should be using network “trust” zones and complement these with external threat intelligence and internal incident detection to understand whom we trust and whom we don’t trust. Then, we should monitor who is communicating with them. This doesn’t mean we should generate a security incident when they do; instead, we should be more cautious and vigilant.

For example, we need to worry a lot more about vulnerabilities on assets if they are talking to untrustworthy actors as opposed to the ones we trust. If assets and users are regularly talking to dubious actors, then those should top our watch list. This should also highlight users who might need additional security training. Very importantly, if any of our crown jewels are communicated with by anything untrusted or unnecessary, we should react quickly.

3. When we have something valuable, we record access

Most companies, and even some private individuals, that recognise a risk to their valuables will deploy systems to track access to their property, such as CCTV, keycards and phone-tracking apps. Most don’t sit and look at this data all day; instead, they record it and store it so that if an incident occurs, it’s possible to look back and see exactly what happened. Most importantly, we can learn how to stop any breach from happening again in the future.

Again, in the virtual world, we should be worried about being compromised. Threats are pervasive. The Internet communication vector means they will always have an attack surface, so we must, at a minimum, record everything. We need to ensure our security systems are going to give us the visibility we need when a security incident occurs — and it will occur. We need to record logs, net flows and packet capture data so that when we need it, we have fast and easy access to understand what happened. When an incident occurs we need to be able to quickly and confidently tell stakeholders what happened and how we will prevent it from happening again.

4. It is second nature

For the vast majority of people, physical security is second nature. We lock doors and windows, hide our valuables and are immediately more vigilant around people we don’t know and trust. It is bred into us at an early age.

Just like physical security, cyber security needs to become second nature to everyone, not just a few people. Everyone should know what is secure, what isn’t and what needs to be. Just like being aware of real-life burglars, everyone needs to think like a cybercriminal. Just like we are inherently cautious of strangers offering services at our front door, we need to be equally wary of emails and social connections. Instilling this culture will take time, but it can be helped through constant reminders and targeted training of those in high-value positions and those who are a bit loose with their URL clicking, Web browsing and third-party application downloads and use.

>See also: Should CEOs take responsibility for cyber-physical security incidents?

We could go on and draw more parallels between cybersecurity and other areas that deal with defence. This approach can really give a different perspective and help us clearly see that forest in one of the most challenging, dynamic and all-consuming business and personal issues today.

Sourced from Martin Borrett, IBM Institute for Advanced Security Europe