As A Business Leader, You Must Manage Cyber Risk 

Cyber attacks are a key risk for boards and happen more often than people think. Such criminal acts usually make the headlines when they involve large data breaches or significant public disruption. The extensive use of technology in every facet of the business world urgently calls for security solutions that keep corporate networks and user data safe. 

Cyber crime is carried out using tactics such as stealing access credentials and infecting systems with malware, ransomware and phishing – poses a threat to data, processes, systems and customers. Even worse, cyber criminals might initiate a breach and exploit the incident by shorting the shares of their victims. Cyber security is therefore increasingly important for Directors.

Addressing cyber risk is a challenge for nearly any company and its board. Cyber is a complex, technical area with emerging threats occurring almost weekly. Most board members are not cyber experts, yet boards have an obligation to understand and oversee this significant risk. They need active engagement with leadership, access to expertise, and robust information and reporting from management. 

While some companies are keeping pace, many are working to upgrade their infrastructures and can miss key gaps in cyber security. The latest spate of ransomware attacks across large enterprises with deep pockets and public agencies suggests no one is immune. As cyber security is becoming a major focus in many corporate boardrooms, the growing threat of ransomware and systemic risks facing corporations today are making it an even more critical topic. 

Any director seeking to add value to corporate stakeholders should have an appreciation for this growing risk. 

As the US Securities and Exchange Commission (SEC) about to publish new regulations requiring publicly traded corporations to document their risk mitigation measures and name who on the board is a cyber security lead, we expect all boards will be revisiting the optimal ways to manage cyber risk. Corporate Directors should not wait for final rules from the SEC to start gap analysis on how the corporation is managing cyber risk. 

Some steps that can be taken right away:

  • Boards should be talking with management now to make sure there is clarity on current corporate processes and procedures for incident response and for cyber risk mitigation governance. A gap assessment should be conducted to assess the difference between best practices and current corporate practices.
  • All directors should seek to understand and mitigate cyber risk by leveraging expert advice from experienced risk management professionals. External advisors can rapidly evaluate board expertise relevant to the cyber security qualifications and can recommend additional training for the full board or the board designated cyber expert.
  • Every business is different. The threat to your business needs to be contextualised to be mitigated. For most large complex organisations this will probably mean convening a strategy session with key leaders from across the organisation where the new nature of the threat can be discussed. which leads to the next key recommendation, this needs to be treated as a business issue not just a security issue.
  • Ensure planning involves business leadership, not just IT and Security. Cyber attacks against the nation’s infrastructure and against infrastructures of other nations where your business or suppliers operate are issues for all leaders, not just cybersecurity and technology leaders. Leaders should examine topics of business resiliency and disaster response with an attitude towards long term business survival and support actions that will enable improved overall business resilience.
  • Many boards will decide to form cyber security committees so a few designated board members can work issues with management outside of board meetings.
  • Monitor execution, especially on actions requiring people to think differently. The cyber threat is so different it may be cause for actions many organisations never planned for.  For example, organisations may need to rapidly learn to use new “out of band” secure communication systems for executive communications and for communications with staff and all employees. 
  • Organisations may even need to revert to manual paper copy interactions with suppliers, banks and other stakeholders. Boards may need to meet and exercise governance without access to online data of any sort. 

Understanding Cyber Security

Above all, a board of directors must understand that cyber security is a dynamic discipline that requires unending monitoring and innovation. Laying the groundwork for reduced risk is essential but so is the knowledge that risk will always be there. Companies should also assess their existing insurance policies, whether they adequately cover asset value in the event of a breach, and if dedicated cyber insurance may help further mitigate risk. 

No matter the size of your insurance policy, leadership must remain involved and educated in cyber security for the business and prepare policies and procedures in the event of a breach with an eye toward responsibility.

Business leaders need to take action to keep informed of emerging cyber security, geopolitical and technological developments that contribute to systemic risks and that you check the links below and sign up for Cyber Security Intelligence’s Directors Report series, exclusively available to premium subscribers (below).

ZScaler:      IMD:     PWC:   Corporate Governance Institute:     Dataminr:     Oodaloop:  

You Might Also Read: 

Wanted - A New Generation Of Cyber Security Leaders:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Soft Cell Hackers Have New Targets
Selling Digital Insecurity »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Mitek Systems

Mitek Systems

Mitek's global mobile capture and identity verification technology optimizes the digital user experience for thousands of financial services organizations.

NSEIT

NSEIT

NSEIT offers end-to-end Information Technology products, solutions and services including cybersecurity to organizations in the financial sector.

CERT Tonga

CERT Tonga

CERT Tonga is the national Computer Emergency Response Team for Tonga.

Cybersecurity Tech Accord

Cybersecurity Tech Accord

The Cybersecurity Tech Accord promotes a safer online world by fostering collaboration among global technology companies.

Redborder

Redborder

Redborder is an Open Source network visibility, data analytics, and cybersecurity Big Data solution that is scalable up to the needs of enterprise networks and service providers.

Affinity IoT

Affinity IoT

Affinity IoT certifies the security features of interconnectable devices.

Sigma IT

Sigma IT

SIGMA IT is one of the largest IT services organizations in EMEA region providing a full range of solutions and services including cybersecurity, data protection and business continuity.

PeopleSec

PeopleSec

PeopleSec specializes in the human element of cybersecurity with a comprehensive set of services designed to maximize your security by educating your workforce as a whole.

Sovereign Intelligence

Sovereign Intelligence

Sovereign Intelligence provides automated insight into the relative intensity of hidden Cyber, Brand, and Financial Risks to your company.

Riskaware

Riskaware

CyberAware, by Riskaware, provides business-critical cyber attack analysis and impact assessments using NIST standards aligned with NCSC guidance.

Wolverhampton Cyber Research Institute (WCRI)

Wolverhampton Cyber Research Institute (WCRI)

Wolverhampton Cyber Research Institute builds on the strength of its members in the area of network and communication security, artificial intelligence, big data and cyber physical systems.

Dasera

Dasera

Dasera’s Radar and Interceptor products deliver visibility, governance, and protection solutions for data-agile companies.

Wavex Technology

Wavex Technology

Wavex Technology is an award winning IT Services firm offering clients a secure and fully managed IT service.

Liquis Inc.

Liquis Inc.

Liquis, founded in 2002, is one of the largest facility decommissioning services companies in the U.S.

B2Bcert

B2Bcert

B2BCERT one of the top companies offering ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 27001, ISO 20000,CE Marking, HACCP, and other globally accepted standards and Management solutions.

Red Helix

Red Helix

Red Helix (formerly Phoenix Datacom) is a market leader in network performance and cyber security.