Business Leaders Can Make Big Mistakes About Cyber Security

The past two years of Coronavirus been very challenging for many businesses, both large and small. Some had to close their offices and rapidly convert the workforce to remote working for their employees, pushing through frequently incomplete digital transformation strategies to make it happen as quickly as possible.

Many of these business discovered that protecting their operations from from cyber threats suddenly became much more urgent and business leaders were hard -pressed to get up to speed in understanding and dealing with their organization' heightened level of cyber risk.

Today, every business needs to address cyber security to operate in the online world and regardless of the size of the business, the reality is that cyber security is not just the domain of security professionals or its executives. Every single employee within a company has a hand in the protection of the business, as they handle company data, manipulate it, and communicate it as part of their jobs.

Business leaders must trust their employees with sensitive data to ensure they can effectively do their jobs. But a data breach involving sensitive board information can result in costly litigation and devastate an organisation’s reputation. Cyber criminals are acutely aware of the gateway that employees create for malicious activity. This is evidenced by the fact that long weekends and public holidays are the preferred time for cyber criminals to attack, as IT staff are unlikely to be monitoring activity, making it more difficult for companies to react quickly.

At the same time, company Boards and Senior Executives have experienced a much higher level of personal jeopardy, with CEOs forced out of their jobs as a result of inadequate performance when confronted with cyber security issues, like breaches, data loss, heavy ransom demands, reputational damage and often crushing financial consequences.

Although cyber security is now most definitely on the board’s agenda in most organisations, it is rarely a fixed item. More often than not, it makes appearances at the request of the Audit & Risk Committee or after a question from a non-executive director, or in response to a security incident or a near-miss. All this hides a pattern of recurrent cultural and governance attitudes which could be hindering cyber security more than enabling it.

There are three big mistakes the business leaders need to avoid to promote cyber security and prevent breaches.

Downgrading       

Every organisation is different and the COVID crisis is affecting each one differently, but pretending that the protection of the business from cyber threats is not a relevant board topic is both negligent and consequently an issue r of poor governance which non-executive directors have a duty to recognise and and address.

  • Cyber attacks are in the news every week and have been the direct cause of millions in direct losses and hundreds of millions in lost revenues in many large organisations across almost all industry sectors. 
  • Data privacy regulators have suffered setbacks in 2020: They have been forced to adjust down some of their fines, and we have also seen a first successful challenge in Austria leading to a multi-million fine being overturned. Regulatory fines are now becoming very costly, potentially reaching 4% of global turnover under GDPR regulations and the risks should certainty register with most company boards.
  • The Coronavirus crisis has made most businesses heavily dependent on digital services, the stability of which is built on sound cyber security practices, in-house and across the supply chain. Cyber security has become as pillar of the “new normal” and even more than before, should be a regular board agenda, clearly visible in the portfolio of one member who should have part of their remuneration linked to it. 

Treating It As Exclusively An IT Problem     

This is a dangerous mistake to make at a number of levels. Cyber security has never been a purely technological matter and the protection of the business from cyber threats has always required concerted action at people, process and technology level across the organisation. Reducing it to a technical issue downgrades the subject, and as a result the calibre of talent it attracts.

  • In large organisations it can led to a persistent failure to address cross-silo issues around identity or vendor risk management, in spite of the millions spent on those matters with tech vendors and consultants. It should not be left to the CIO to deal with, unless their profile is sufficiently elevated within the organisation. 
  • Alternative organisational models don't necessarily deal with the challenges of the digital transformation and the prioritisation of data privacy, even taking proper account GDPR. It is quite easy, in particular in large firms, to over-engineer the three lines of defence and to build monstrous and inefficient control models. Proper cyber security depends upon trust, and must bring a visible benefit to each part of the control organisation to avoid creating a culture of blame and finger-pointing.

Throwing Money At The Problem        

Protecting an organisation from cyber threats is a mindset that is best ingrained in an organisation's culture, not something you can simply purchase of the shelf. Indeed, most of the breached organisations of the past few years would have spent collectively tens or hundreds of millions on cyber security products over the last decade.

A lack of adequate investment in workforce skills and cybersecurity training  is certainly risky, as IT teams struggle to keep corporate networks operational and secure  when the rise in remote working is adding to their security challenges.

CISOs need to be in communication with the board in order to ensure that they understand  the needs of cyber security and that they are making the right levels  investment, but where the level of cyber security awareness among the workforce is low and a major change in culture and attitude is required, just spending money at the problem is not the answer. It is more important to focus on a providing leadership in building cyber security awareness.

This needs to start at the top of the organisation, with a highly  visible and credible board commitment, that can be promulgated throughout  the organisation.

Technative:      HelpNetSecurity:       Information-Age:    DLA Piper:      ZDNet:     Image: Unsplash

You Might Also Read: 

Cyber Security Is The CEO’s Biggest Problem:

 

« Webinar: Adapting detection and response strategies to the cloud
Businesses Pay A High Price For Automated Bots »

Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Perimeter 81

Perimeter 81

Perimeter 81 is a Zero Trust Network as a Service designed to simplify secure network, cloud and application access for the modern and distributed workforce.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Cylance Smart Antivirus

Cylance Smart Antivirus

An antivirus that works smarter, not harder, from BlackBerry. Lightweight, non-intrusive protection powered by artificial intelligence. BUY NOW - LIMITED DISCOUNT OFFER.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Free Access: Cyber Security Supplier Directory listing 5,000+ specialist service providers.

Sirama Consulting

Sirama Consulting

Sirama is an IT consulting firm which caters to small businesses. Services include Network Security, Backup & Disaster Recovery, Mobile Device Management.

Cloudera

Cloudera

Cloudera provide the world’s fastest, easiest, and most secure data platform built on Hadoop.

Polyverse

Polyverse

Polyverse offers application security, zero-day defense, proactive cyber resiliency and more. Protect your critical applications with moving target defense.

Nexus Group

Nexus Group

Nexus Group develops identity solutions for physical and digital access.

Bridewell Consulting

Bridewell Consulting

Bridewell Consulting provide cost effective Security & Risk Assurance Services across Information Security, Cyber Security, Technology Risk, Security Testing and Data Privacy.

Transmit Security

Transmit Security

The Transmit Security Platform provides a solution for managing identity across applications while maintaining security and usability.

KanREN

KanREN

KanREN is a member based consortium offering custom, world-class network services and support for researchers, educators, and public service institutions in the state of Kansas.

Motiv ICT Security

Motiv ICT Security

Motiv is the ICT security specialist that provides public and private sector organisations with IT security solutions and services to prevent cybercrime, data theft and data breaches.