Boards Need To Step Up Or Risk Cybersecurity Fines

Protecting companies against the threat of cyber attacks used to be something that the IT department would be tasked with. Leaving tech to the tech experts seemed to make perfect sense. So long as the Board had appointed the right people for their job, many Board members felt their work was done, aside perhaps from hearing the occasional update from the IT department manager. 

What would be the point of interfering in matters that may be outside of their areas of expertise, after all? Let tech deal with tech, to free the Board up for more pressing matters.

The Daily Threat Of Cyber Attacks

But now, cyber attacks are not distant threats that happen to other organisations; they’re a daily reality, and no company is safe, regardless of their industry or size. A survey by the UK Government revealed that in 2022, 39% of UK businesses identified a cyber-attack. Out of the organisations who had reported attacks, 31% of businesses and 26% of charities estimated they were attacked at least once a week.

Fines - Insult To Injury Or Just Desserts?

On top of the sheer number of attacks, the costs to businesses can be staggering.  According to CISCO, data breaches are likely to cost, on average, 20% of a company’s turnover. There is also the high likelihood of businesses being hit with a substantial fine. Insult to injury? Perhaps, but when a Board has failed to take adequate preventative measures to safeguard their customer data, a fine may be viewed as appropriate punishment. A vital lesson in standing up and taking responsibility.

What Can The Board Do? 

If the recent £4.4m fine imposed on Interserve by the ICO has taught companies anything, it should be that understanding cybersecurity risks and investing in all the right technology is simply not enough to protect themselves from receiving a hefty fine. 

Like many firms, Interserve wasn’t ignorant to the real threat of an attack, nor was it reluctant to put the right tech in place. Where they failed was monitoring that tech and taking action when suspicious activity was flagged. They fell at the final hurdle and that cost them - big time.

Remaining resilient to the ever-evolving threats of cyber-attack requires a robust strategy driven by the Board that is constantly maintained and monitored. To put it simply, firms without watertight cyber resilience strategies are risking everything.

What is certain is that more eye-watering fines will continue to hit the headlines. 

There is a tendency for Boards to think that once they’ve invested in cybersecurity tech, they’ve done their job. This is a dangerous assumption. The vital part in a successful cyber strategy, which is still missing in all too many companies, is a security operations centre (SOC) service - experts who know how to monitor the tech, interpret the data and what to do when an alert is flagged.
 
Having all the tools but lacking a SOC service is only going halfway to protecting your organisation - which, in today’s cyber threat environment, isn’t nearly far enough. A SOC service provided by a trustworthy and reliable supplier means the difference between resilience and total vulnerability.”

Delivering Competitive Advantage

The Financial Times published the results of a survey by MIT Sloan and Proofpoint, a California cybersecurity company, which showed that Board members’ biggest fears on encountering a cyber attack, were data being made public, reputational damage and revenue loss

All these fears are well-founded, but what about the potentially devastating effects of being fined? Not to mention the cost of cyber insurance after a fine has been imposed. And then there’s losing out to competitors - many organisations are now refusing to work with partners who do not have a SOC service in place, as it means their data is vulnerable.

We have customers who came to us because they knew their cyber-attack resilience was weak and it was causing them to lose sleep. Having a SOC service in place gives Board members enormous reassurance that they’re doing everything they can to mitigate an attack - and can prove it if the ICO ever does come knocking.

Rob Demain is CEO & Founder of e2e-assure

You Might Also Read: 

How Do You Solve A Problem Like The Cyber Security Skills Gap?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« US Strategy Will Allow Hacking Criminal & Foreign Networks 
Choose the best web application firewall for you »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

IX Associates

IX Associates

IX Associates is a UK based IT Integration business specialising in risk, compliance, eDefence, and network security solutions.

CyberPilot

CyberPilot

CyberPilot ApS is a Danish cybersecurity company. We work with all types of companies and organisations, both large and small, who want to achieve effective cybersecurity.

Fluency Security

Fluency Security

Fluency is the only Security Analytics & Orchestration (SAO) solution that automates correlation, detection, validation and ongoing tracking.

Samoby

Samoby

Samoby provide a subscription solution for Mobile Threat Protection and usage control on Android and iOS devices.

Irish National Accreditation Board (INAB)

Irish National Accreditation Board (INAB)

INAB is the national accreditation body for Ireland. The directory of members provides details of organisations offering certification services for ISO 27001.

Solidified

Solidified

Solidified is the largest audit platform for smart contracts. Our community has the highest concentration of top Blockchain security specialists and best-in-class code auditors.

Data Theorem

Data Theorem

Data Theorem is a leading provider in modern application security. Its core mission is to analyze and secure any modern application anytime, anywhere.

AppOmni

AppOmni

AppOmni is the only SaaS CSPM solution that gives teams all the tools they need to be successful – from security posture management to monitoring and detection to continuous compliance.

Blackfoot Cybersecurity

Blackfoot Cybersecurity

At Blackfoot, we work in partnership with you to deliver on-demand cyber security expertise and assurance, keeping you one step ahead of threats & compliant with regulations.

SecurityGate

SecurityGate

SecurityGate.io is the only Integrated Risk Management platform built for OT/ICS cybersecurity. The leading Risk Assessment Platform for Critical Infrastructure.

Sovrin Foundation

Sovrin Foundation

The Sovrin Foundation is a private-sector, international non-profit that was established to govern the world's first self-sovereign identity (SSI) network.

Networks Unlimited

Networks Unlimited

Networks Unlimited is a leading value-added distributor in Africa, providing technology solutions with a focus on security, networking, enterprise systems management and cloud technologies.

AEWIN Technologies

AEWIN Technologies

AEWIN is professional in the fields of Network Appliance, Cyber Security, Server, Edge Computing and an ODM/OEM expert.

Noname Security

Noname Security

Noname Security detects and resolves API vulnerabilities and misconfigurations before they are exploited.

Computacenter

Computacenter

Computacenter is a leading independent technology partner, trusted by large corporate and public sector organisations. We help our customers to source, transform and manage their IT infrastructure.

TDi Technologies

TDi Technologies

TDI Technologies' flagship solution ConsoleWorks, is an IT/OT cybersecurity and operations platform for Privileged Access Users.