How have you integrated security considerations into routine IT decision-making processes to break down silos and ultimately close security gaps?

Security is now embedded in every aspect of our operations, although our culture is still adapting. For example, we have established standards for email access and now send security risk assessments to vendors. Security is a regular topic at board meetings, and recent incidents have led to revamping help desk processes, including implementing MFA and restricting password resets. The institution is increasingly proactive in engaging with security concerns.

Managing both IT and security makes integration easier. MFA has been crucial in preventing BEC attacks, and we use tools like Cisco Duo and Microsoft Authenticate. With the shift to SaaS solutions, MFA is essential for single sign-on. Every IT change is evaluated for security implications, including new applications and password management. Security is always the top priority.

The pace of threats has increased, and AI has given bad actors access to advanced tools. Most corporate applications are SaaS, requiring verification of vendor security protocols. We obtain SOC reports and, when necessary, enter into business associate agreements. Security reviews now extend beyond IT to marketing, sales, and other departments.