Boards Need To Step Up Or Risk Cybersecurity Fines

Protecting companies against the threat of cyber attacks used to be something that the IT department would be tasked with. Leaving tech to the tech experts seemed to make perfect sense. So long as the Board had appointed the right people for their job, many Board members felt their work was done, aside perhaps from hearing the occasional update from the IT department manager. 

What would be the point of interfering in matters that may be outside of their areas of expertise, after all? Let tech deal with tech, to free the Board up for more pressing matters.

The Daily Threat Of Cyber Attacks

But now, cyber attacks are not distant threats that happen to other organisations; they’re a daily reality, and no company is safe, regardless of their industry or size. A survey by the UK Government revealed that in 2022, 39% of UK businesses identified a cyber-attack. Out of the organisations who had reported attacks, 31% of businesses and 26% of charities estimated they were attacked at least once a week.

Fines - Insult To Injury Or Just Desserts?

On top of the sheer number of attacks, the costs to businesses can be staggering.  According to CISCO, data breaches are likely to cost, on average, 20% of a company’s turnover. There is also the high likelihood of businesses being hit with a substantial fine. Insult to injury? Perhaps, but when a Board has failed to take adequate preventative measures to safeguard their customer data, a fine may be viewed as appropriate punishment. A vital lesson in standing up and taking responsibility.

What Can The Board Do? 

If the recent £4.4m fine imposed on Interserve by the ICO has taught companies anything, it should be that understanding cybersecurity risks and investing in all the right technology is simply not enough to protect themselves from receiving a hefty fine. 

Like many firms, Interserve wasn’t ignorant to the real threat of an attack, nor was it reluctant to put the right tech in place. Where they failed was monitoring that tech and taking action when suspicious activity was flagged. They fell at the final hurdle and that cost them - big time.

Remaining resilient to the ever-evolving threats of cyber-attack requires a robust strategy driven by the Board that is constantly maintained and monitored. To put it simply, firms without watertight cyber resilience strategies are risking everything.

What is certain is that more eye-watering fines will continue to hit the headlines. 

There is a tendency for Boards to think that once they’ve invested in cybersecurity tech, they’ve done their job. This is a dangerous assumption. The vital part in a successful cyber strategy, which is still missing in all too many companies, is a security operations centre (SOC) service - experts who know how to monitor the tech, interpret the data and what to do when an alert is flagged.
 
Having all the tools but lacking a SOC service is only going halfway to protecting your organisation - which, in today’s cyber threat environment, isn’t nearly far enough. A SOC service provided by a trustworthy and reliable supplier means the difference between resilience and total vulnerability.”

Delivering Competitive Advantage

The Financial Times published the results of a survey by MIT Sloan and Proofpoint, a California cybersecurity company, which showed that Board members’ biggest fears on encountering a cyber attack, were data being made public, reputational damage and revenue loss

All these fears are well-founded, but what about the potentially devastating effects of being fined? Not to mention the cost of cyber insurance after a fine has been imposed. And then there’s losing out to competitors - many organisations are now refusing to work with partners who do not have a SOC service in place, as it means their data is vulnerable.

We have customers who came to us because they knew their cyber-attack resilience was weak and it was causing them to lose sleep. Having a SOC service in place gives Board members enormous reassurance that they’re doing everything they can to mitigate an attack - and can prove it if the ICO ever does come knocking.

Rob Demain is CEO & Founder of e2e-assure

You Might Also Read: 

How Do You Solve A Problem Like The Cyber Security Skills Gap?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« US Strategy Will Allow Hacking Criminal & Foreign Networks 
Choose the best web application firewall for you »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

European Council on Foreign Relations (ECFR)

European Council on Foreign Relations (ECFR)

ECFR is a pan-European think-tank conducting research and promote informed debate on European foreign policy. Cyber security is becoming an intrinsic element of foreign policy debate.

Tanium

Tanium

Tanium is an endpoint security and systems management company.

Echelon

Echelon

Echelon Company is a provider of information security services specializing in certification of security software and hardware products in Russia.

Octopus Cybercrime Community

Octopus Cybercrime Community

The Octopus Community is a platform for information sharing and cooperation on cybercrime and electronic evidence.

CloudCheckr

CloudCheckr

CloudCheckr is a next-gen cloud management platform that unifies Security & Compliance, Inventory & Utilization and Cost Management.

Modux

Modux

Modux focus on a number of core competencies across cyber security including; cyber intelligence & analytics, penetration testing and training.

National Authority for Electronic Certification and Cyber Security (AKCESK)

National Authority for Electronic Certification and Cyber Security (AKCESK)

AKCESK ensures security for trusted services, in particular reliability and security in electronic transactions between citizens, businesses and public authorities.

Styra

Styra

Styra allows companies to secure cloud environments and applications, including those built on the popular Kubernetes open-source cloud platform.

Salt Security

Salt Security

Salt Security protects the APIs that are the core of every SaaS, web, mobile, microservices and IoT application.

Business Hive Vilnius (BHV)

Business Hive Vilnius (BHV)

BHV is one of the oldest startup incubator and technology hubs in the Baltics, primarily focused on hardware, security, blockchain, AI, fintech and enterprise software.

Upfort

Upfort

Upfort (formerly Paladin Cyber) unifies award-winning security and robust cyber insurance to deliver comprehensive cyber risk solutions.

Virtue Security

Virtue Security

Virtue Security are specialists in web application penetration testing.

Integrity

Integrity

Integrity is a PCI QSA and ISO 27001 certified company specialized in Information Security and IT Consulting.

Triskele Labs

Triskele Labs

Triskele Labs deliver services including Penetration Testing, Compliance and Risk Management through to 24*7*365 Security Operations and outsourced Cybersecurity Managers.

GovSky

GovSky

GovSky streamlines CMMC compliance, saving time and significantly reducing cost.

NinjaOne

NinjaOne

The NinjaOne Platform was built to help IT and MSP teams efficiently manage, patch, and support all endpoints.