Start With Common Sense
I’ve spent a lot of years in Information Technology (IT), and one thing I’ve learned is that you can spend an unbelievable amount of money on cybersecurity and still not be secure.
Automotive dealerships are especially interesting because there are a LOT of moving parts. Multiple locations, hundreds or thousands of users and devices, Dealer Management Systems (DMS), Original Equipment Manufacturer (OEM) connections, Microsoft 365, networks, endpoints, payment systems, customer financial information, third-party vendors and a pile of regulatory requirements.
So, if I were responsible for securing a dealership or dealer group, here’s what I’d do.
Before buying anything, I’d figure out what we already have and what actually needs to be fixed.
I’d start with a comprehensive IT and cybersecurity assessment. Networks, firewalls, wireless, Microsoft 365, endpoints, backups, identity, remote access, vendors, DMS integrations, policies, security tools and who has access to what.
Then I’d ask some really basic questions.
Are we patching things? Is Multi-Factor Authentication (MFA) turned on everywhere it should be? Are old accounts disabled? Do users have administrative rights they don’t need? Can someone in the service department talk directly to systems in accounting? Can we restore our backups? Are we protecting sensitive customer information? Who gets an alert at 2:00 AM when something bad happens?
Cybersecurity doesn’t always need to be complicated. Sometimes the biggest risks are sitting right in front of us.
Build Around Zero Trust
“Zero Trust” gets thrown around a lot, but the concept is actually pretty simple: don’t automatically trust someone just because they’re inside your network.
Verify the user. Verify the device. Give them access only to what they need. Keep verifying.
That means strong identity management and MFA, network segmentation, modern firewalls, secure internet access, Endpoint Detection and Response (EDR), vulnerability management, and secure remote access.
This is an area where we use Cisco extensively. Technologies such as Cisco Duo provide strong identity and MFA capabilities. Cisco Umbrella adds Domain Name System (DNS) and internet security to help stop users and devices from reaching malicious destinations. Cisco Secure Access extends that model toward modern Zero Trust and cloud-delivered security, while Cisco’s networking and firewall platforms help us segment and protect the infrastructure itself.
But buying Cisco isn’t the strategy. Designing the environment correctly is the strategy.
And before replacing technology, I’d look at what the dealership already owns. If something is working and can be properly secured and managed, there may be no reason to replace it.
That’s where common sense needs to beat the sales quota.
Don’t Forget Microsoft 365
Microsoft 365 is effectively part of the dealership’s security perimeter.
Email, SharePoint, OneDrive, Teams and identity contain an enormous amount of business and customer information. Before buying another shiny security product, I’d make sure we’re taking advantage of the security capabilities already available within the dealer’s Microsoft licensing.
Depending on licensing, that can include Conditional Access, Microsoft Defender, identity protection, email security and Data Loss Prevention (DLP).
DLP is particularly important. We spend a lot of time trying to stop bad guys from getting into networks, but we also need to think about how sensitive information gets out.
Social Security numbers, driver’s licenses, credit applications, and financial information shouldn’t be casually emailed, copied to personal cloud storage or downloaded onto unmanaged devices.
Sometimes the best cybersecurity investment is simply configuring the technology you’re already paying for.
Assume Someone Will Eventually Get Through
No matter how good the technology is, I’d operate under the assumption that eventually someone will click something they shouldn’t, a password will get compromised, a vendor will have a problem, or an attacker will find another way in.
That’s why every dealer group needs 24×7 security monitoring.
I’d want a Security Operations Center (SOC) and Security Information and Event Management (SIEM) capability continuously monitoring the environment, correlating security events and, most importantly, putting qualified humans behind those alerts who can investigate and respond.
That’s where a partner such as NetraVine fits into the architecture, providing the specialized monitoring and security operations capability behind the environment.
Because attackers don’t care that your IT guy is on vacation.
Compliance Should Be Part of the Program, Not an Annual Fire Drill
Automotive dealerships also have some very real compliance obligations.
Most dealerships that arrange financing or leasing fall under the Federal Trade Commission (FTC) Safeguards Rule, which requires covered financial institutions to maintain a written information-security program designed to protect customer information.
There is also the FTC Privacy Rule under the Gramm-Leach-Bliley Act (GLBA), which addresses how covered businesses handle consumers’ nonpublic personal information.
Dealerships accepting payment cards also need to understand their obligations under the Payment Card Industry Data Security Standard (PCI DSS).
Depending on where the dealerships operate and the information they maintain, state privacy, consumer-protection and data-breach notification laws may add additional requirements.
I wouldn’t treat these as separate projects.
A lot of the requirements overlap with things a dealership should be doing anyway: risk assessments, MFA, access controls, encryption, logging and monitoring, vendor management, employee awareness, incident response, vulnerability management and protecting sensitive information.
I’d use a Governance, Risk and Compliance (GRC) platform such as Drata to help bring all of that together.
Drata can help automate evidence collection, continuously monitor controls and provide visibility into the dealership’s overall compliance program. Instead of chasing screenshots, spreadsheets, and documents once a year, compliance becomes part of everyday IT operations.
Now Put People Around All of It
Here’s the part that I think gets missed. Someone still has to run all this stuff.
You might need a fractional and Virtual Chief Information Security Officer (vCISO) for strategy and risk. A security architect to design the environment. A network engineer to implement segmentation. A Microsoft engineer to secure Microsoft 365. A GRC specialist to manage Drata and compliance. A project manager to coordinate everything. A SOC watching the environment around the clock.
Most dealerships don’t need all of those people full-time. They just need access to them when they’re needed.
That’s exactly why we built NetraVine’s Team as a Service (TaaS).
Instead of hiring an entire IT and cybersecurity organization or trying to coordinate a collection of disconnected vendors, NetraVine can provide the resources required to assess, design, implement, secure and manage the environment.
TaaS allows us to plug the right skillset into the dealership when it’s needed and wrap those resources around the technology and services the dealership already owns.
That can become a predictable monthly operating model covering cybersecurity, infrastructure, compliance, Microsoft 365, vendor coordination, SOC oversight and ongoing improvement.
And Here’s the Part That’s Really Important to Me: You Own It
This is a major difference in how NetraVine approaches managed IT and cybersecurity.
We don’t want to own your stuff.
The dealer owns the Cisco hardware. The dealer owns the Microsoft licensing. The dealer owns Drata. The dealer owns the security tools, configurations, documentation, and data.
NetraVine helps you select it, negotiate it, architect it, implement it, manage it and continuously improve it.
Some managed-service models bundle hardware and software into the service. Stop paying the provider and suddenly you have to figure out what technology is actually yours. I don’t like that model.
If someday you decide you don’t need NetraVine anymore, you shouldn’t have to replace half your infrastructure or unwind your security environment just to leave us.
I’d rather keep a customer because we’re providing value than because we’ve made leaving painful.
The Goal Isn’t More Cybersecurity Stuff
If I were responsible for securing an automotive dealership or dealer group, I wouldn’t start by asking: “What security products should we buy?”
I’d start with: What are we trying to protect? Where are the real risks? What technology do we already own? What controls are missing? Who is watching the environment? Who is managing all of this? And can we prove it’s working?
Assess it. Fix the basics. Apply Zero Trust principles. Protect the data. Monitor it 24×7. Build compliance into everyday operations. Test recovery. Continuously improve it. And put experienced people around the whole thing. That’s what NetraVine’s Team as a Service (TaaS) is designed to do.
You don’t necessarily need more tools. You need the right tools, configured correctly, monitored continuously, and managed by the right people.
| Reach out to NetraVine and see how our TaaS solutions can help solve your IT and cybersecurity problems economically, without having to build the entire team yourself. |
