Businesses cybersecurity strategies have undergone many changes over the past 18 months as a result of remote work, greater use of the cloud and increasing sophistication of cyberattacks.

For payroll firm ADP Inc., that meant retooling technology and controls, reinforcing existing processes and, most importantly, intensifying company-wide involvement, according to Dave Martin (pictured), chief security officer at ADP.

“Everybody has a play here … we’ve really got to be that call to action, we’ve got to explain why this is important,” he said. “We will never be successful just being the security team that tries to do everything. It’s bringing everyone along for the journey.”

Martin spoke with Dave Vellante, host of theCUBE, SiliconANGLE Media’s livestreaming studio, during the Commvault Connections21 event. They discussed the security challenges that have arisen recently, how chief security officers have changed their practices to respond to these threats, ADP’s new strategies in this scenario, and the role of Commvault Systems Inc. (* Disclosure below.)

The key role of data recovery

Because of the growing complexity of IT environments and therefore cyberattacks, it is almost impossible for enterprises to protect themselves 100% from them. ADP itself was recently a victim of hackers, like so many other businesses. This is why the defense strategy against criminals must rely on protection, but also on data recovery, according to Martin.

The first step in an effective strategy is to understand which activities cannot be interrupted and which data should be better protected and made available, Martin explained. Then, the company must go through the cybersecurity framework to make sure it is doing the best in prevention, detection and response around those areas.

If a cyberattack occurs, recovery tools must be available and teams must be ready to act. ADP is using Commvault software to help manage this process.

“So partnering with everyone in the environment, it takes a village to defend against this kind of threat, getting everyone engaged, the experts in each of these fields to make sure that we’re thinking they understand these threats and how real it is and what their role is going to be in setting up that protection and defense,” Martin stated.

The need to empower teams to act

Another critical aspect of a successful security and recovery strategy is involving the company’s top leaders, according to Martin. They should meet before problems occur to discuss decisions to be made in emergency scenarios and to empower teams to do this as seamlessly, quickly and effectively as possible.

“You don’t want to be at 2 AM looking for the CEO or the executive team to get them out there to make a decision,” he explained. “Some of these decisions need to be made very quickly and very effectively, and you can only do that with empowered upfront and sometimes even automated processes to do them.”

At ADP, “tabletop” events take place at least once a year when the main leaders are challenged with an issue and need to work through the steps to resolve it.

“So, come that dark day, if it ever does … they understand the technical background of why they’re being asked to make a decision and the limitations of what their response may be,” Martin said.

Watch the complete video interview below, and be sure to check out more of SiliconANGLE’s and theCUBE’s coverage of the Commvault Connections21 event. (* Disclosure: TheCUBE is a paid media partner for the Commvault Connections21 event. Neither Commvault Systems Inc., the sponsor for theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE