Business Cybersecurity Strategy

In the last decade there have been a growing number of cyber-attacks on business. 

A huge range of organisations and companies around the world have been affected by the WannaCry ransomware cyber attack, described by the EU's law enforcement agency as "unprecedented".

From "cyberwar" to "hacktivism", there have been some of the major cyber-attacks over the past 10 years. The Petya ransomware attack which took place in June 2017 paralysed thousands of companies worldwide, and this attack reinforced the new EU cyber legislation. 

Firms that are breaching the EU’s General Data Protection Regulation (GDPR) next year could be fined up to €20m (£18m). 
This new law is now beginning to make cyber security a crucial issue for all businesses. 

However, we have found that on average, while 93% of businesses surveyed regard it as important, only 56% have established a formal cyber security strategy.

Business Responsibility
The Board is ultimately accountable for the protection of corporate systems. Therefore, they need to develop a cyber security policy, regularly audit their IT systems, educate their staff, review supplier contracts and incorporate about cyber insurance.

Analyse the Risks 
Directors need to ask themselves and all Board members: how confident are they that their business information assets are protected? Who might compromise their security? What forms might the threat take? What effects could an attack have? Have they had analysis of their business’s systems and had a report completed and how long ago was this done?  

Completing this work will help your business to implement suitable controls and determine what good practice looks like. Repeat the procedure regularly, continually reassessing the effectiveness of your measures. If a third party manages your IT services, review your agreements with it and ensure that those handling your data also apply these controls.

Understand and Follow the Law
Ensuring that your business follows the strict data protection principles outlined by the Information Commissioner’s Office (ico.org.uk) and enforced by the Data Protection Act 1998 will help to shield it from attacks, prosecutions, fines and reputational harm. 

These stipulate that the data held and processed by your firm must be kept securely; be used fairly and lawfully for specific, limited purposes; and not be moved outside the EEA without adequate protection. 
Also, planning and implementing the changes that your firm needs to make to comply with the GDPR now will ensure its readiness for the legislation when this comes into force in 2018.

Getting the Fundamentals Right
Applying basic, effective measures to protect your company’s systems will mitigate many of its cyber risks. You should download and install software updates as soon as these become available, as they often contain security patches. 
Similarly, use strong passwords; delete all suspicious emails, which could contain malware or be phishing attempts; and always use up-to-date anti-virus software.

One of the most crucial measure is to train all staff in these basics and keep them abreast of the latest threats. Human error is often at the root of a breach, the mere opening of an email attachment by an unwitting employee could cause one. 
You therefore need to develop a security-aware culture. The government’s Cyber Essentials scheme sets out five controls that would help to reduce cyber-attacks on your company.

Cyber Security Insurance
Insurance is not yet widely viewed as a cyber security measure. Indeed, only 22 per cent of business we have spoken to have taken out such cover for their firms. 

But products in this area can insure against a range of risks, including network security liability, data and software damage, business interruptions and reputational harm. 

Although some events, including the theft of intellectual property, remain uninsurable because the associated losses are hard to prove and/or quantify, insurance is likely to feature heavily in any effective cyber strategy in the near future.

Cyber Audit 
We think that the UK should take more of a lead in this area and that the UK government should have standards that should be implemented to enhance Cyber Essentials with a Cyber Audit regulation, which we think is very important once the UK leaves the EU.

The new Cyber Essentials should include a Cyber/IT Audit at least twice a year at unannounced times, training of staff four times a year using on-line training sessions and cyber security insurance policy which takes into account the GDPR regulations along with Cyber Essentials and a checking cyber Audit and all of this would  reduce the cyber security risks and should reduce the cost of a business cyber insurance policy. 

Please contact: Cyber Security Intelligence for more information.

Image: Alpha Stock Images / Nick Youngson

 

« The GDPR Deadline Is Near & Business Is Not Ready
Infraud Cybercrime Site: Dozens Arrested »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Pyramid Computer

Pyramid Computer

Pyramid Computer provides custom enterprise solutions for Industrial PC, Imaging, Network, Security, POS, Indoor Positioning and Automation.

Software Factory

Software Factory

Software Factory develops custom-built high-performance software solutions and products for applications including industrial cyber security.

Cyber Security Specialists

Cyber Security Specialists

Cyber Security Specialists Limited provide Security services across a wide range of markets, from multi-national Corporate Organisations and Government Agencies, through to smaller Businesses.

Global Cyber Alliance (GCA)

Global Cyber Alliance (GCA)

Global Cyber Alliance is an international, cross-sector effort dedicated to eradicating cyber risk and improving our connected world.

Mitre

Mitre

At Mitre we work across government to tackle challenges to the safety, stability, and well-being of our nation. Areas of expertise include Cybersecurity.

RIGCERT

RIGCERT

RIGCERT provides training, audit and certification services for multiple fields including Information Security.

SafeLogic

SafeLogic

SafeLogic provides strong encryption products for solutions in mobile, server, Cloud, appliance, wearable, and IoT environments that are pursuing compliance to strict regulatory requirements.

SaltStack

SaltStack

SaltStack develops award-winning intelligent IT automation software. We help businesses more efficiently secure and manage all aspects of their digital infrastructure.

Conference on Applied Machine Learning in Information Security (CAMLIS)

Conference on Applied Machine Learning in Information Security (CAMLIS)

CAMLIS is a venue for discussing applied research on machine learning, deep learning and data science in information security.

TechBase

TechBase

TechBase is an innovation and start-up center offering technology-oriented start-ups optimal conditions for successful business development.

Prism Infosec

Prism Infosec

Prism Infosec is an award-winning independent cyber security consultancy, CREST STAR, NCSC CHECK member, CAA ASSURE audit provider and PCI Qualified Security Assessor.

GeoEdge

GeoEdge

GeoEdge is the premier provider of ad security and quality solutions for the online and mobile advertising ecosystem.

Sourcepass

Sourcepass

Sourcepass is an IT consulting company that focuses on providing expert IT services, cloud computing solutions, cybersecurity services, website, and application development.

Cloud4C

Cloud4C

Cloud4C is a leading automation-driven, application focused cloud Managed Services Provider.

Synergy Quantum

Synergy Quantum

Synergy Quantum has pioneered a proprietary suite of military-grade, quantum-secure communication technologies.

SoteriaSec

SoteriaSec

SoteriaSec is a premier cybersecurity firm providing comprehensive digital forensics and incident response services.