Business Leaders Are Ignoring Cyber Risks

Many medium sized businesses in the UK are ignoring the cyber security attacks they are likely to experience as they often have an incorrect understanding of their company’s cyber competence.  
 
The UK’s cyber-attacks have cost medium sized businesses with income between £15m and £1bn at least £30bn in the past year, a report from advisory firm Grant Thornton.
 
More than half (53%) of the UK’s 500 medium sized companies that were talked to have on average reported losses equivalent to between 3% and 10% of revenue after a cyber-attacks and the companies hit hardest had losses up to 25% of revenue.
 
Apparently regardless of these attacks over 60% of the businesses still do not have a Director who is responsible for cyber security. The organisations interviewed were also under-prepared in terms of making their people aware of cyber risks, with only one in three (36%) providing all their employees with cyber security training in the past 12 months. James Arthur, partner and head of cyber consulting at Grant Thornton, said boards had a key role to play in ensuring they had an effective cyber strategy in place.
 
“Putting cyber-crime onto the board’s agenda is one of the most effective ways to minimise the chances of a successful attack and reduce the financial impact if a breach occurs.” he told Compuetr Weekly.
 
While commitment from the top is vital, Arthur said ensuring employees were properly trained was also essential.
 
“Training to raise employee awareness can have a hugely positive impact on cyber security…so companies of all sizes need to ensure they have regular and ongoing cyber security training in place.”
 
Almost 70% of the company’s respondents felt confident in their ability to respond consistently at any time to a cyber-attack across their entire organisation, the study revealed that over half of the businesses surveyed did not have a cyber incident response plan in place (59%). It is very important to have a cyber security strategy and tactical plan, the report said.
 
The research also found that companies with an incident response plan in place experienced significantly lower financial losses from a cyber-attack than those without one.
 
The report explains that medium sized companies are at risk because they have resources and data that make them an attractive target but they are less likely to implement best-in-class cyber security compared with larger companies.
The study showed that many companies were relying on regular data backups to be able to recover rapidly from cyber incidents.
 
“But with modern ransomware specifically designed to spend up to six months infecting entire networks, including data backups, this cannot be relied upon as a core component of a response plan,” said Arthur.
 
The report identified six key areas that mid-market boards should be focusing on to ensure they are properly prepared:
 
1. Establishing a cyber incident response plan;
2. Regularly rehearsing the response plan using a range of different scenarios;
3. Monitoring and managing the risk posed from their supply chain;
4. Ensuring they understand the terms of their insurance and what is covered;
5. Understanding what “normal” looks like for their business, in terms of application usage, so they can identify any unfamiliar patterns;
6. Investing in regular training and raising their people’s awareness of cyber security.
 
Cyber security need not be expensive and there are a series of easy on-going actions that give organisations a much stronger cyber security process going forward. 
 
 For more information and a very economic and effective review please contact: Cyber Security Intelligence 
 
Computer Weekly:         Grant Thornton
 
You Might Also Read:
 
Ten Reasons Why Senior Managers Need To Understand Cyber Security:
 
 
 
 
« Privacy: Can You Trust FaceApp With Your Face?
From Ciphers To Cyber Security »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Intelligence-sec

Intelligence-sec

Intelligence-Sec is a fully integrated Conferences and Exhibitions Company managing and producing topical events for the security industry.

Netsparker

Netsparker

Netsparker provide a web application security scanner to automatically find security flaws in your websites, web applications and web services.

Allgress

Allgress

Allgress solutions converge disparate risk silos across enterprise networks and automate governance, risk and compliance management processes.

ENVEIL

ENVEIL

ENVEIL’s technology is the first scalable commercial solution to cryptographically secure Data in Use.

Trapmine

Trapmine

TRAPMINE is an innovative cybersecurity products company mainly focusing on protecting organizations from Advanced Persistent Threat & Zero-Day attacks.

Cybertron

Cybertron

Cybertron services include real-time monitoring and incident response and a cyber range for competency development.

Callsign

Callsign

Callsign’s mission is to seamlessly power the identification of every web, mobile and physical interaction.

CryptoCurrency Certification Consortium (C4)

CryptoCurrency Certification Consortium (C4)

The CryptoCurrency Certification Consortium is a non-profit organization that provides certifications to professionals who perform cryptocurrency-related services.

THEC-Incubator

THEC-Incubator

THEC-Incubator program is designed for international and ambitious tech startups in the Netherlands. Areas of focus include Blockchain and Cyber Security.

UKsec: Virtual Cyber Security Summit

UKsec: Virtual Cyber Security Summit

Join 100s of UK Cyber Security Leaders Online for Expert Cyber Security Talks, Strategy Insights, Cyber Resilience Tips and More.

apiiro

apiiro

apiiro invented the industry-first Code Risk Platform™ that uses developers and code behavior analysis to accelerate delivery and automatically remediate product risk.

boxxe

boxxe

boxxe create flexible IT infrastructures, collaborative global workspaces and data clarity, all underpinned by world-leading security.

Turnkey Consulting

Turnkey Consulting

Turnkey Consulting is a leading provider of Integrated Risk Management (IRM), Identity Access Management (IAM), and Cyber and Application Security.

ENSCO

ENSCO

The ENSCO group of companies provides engineering, science and advanced technology solutions that guarantee mission success, safety and security to governments and private industries worldwide.

Udacity

Udacity

Udacity's mission is to train the world’s workforce in the careers of the future. Our programs range from beginner to expert levels and deliver the hands-on skills for real-world expertise.

Nonprofit Cyber

Nonprofit Cyber

Nonprofit Cyber is a first-of-its-kind coalition of global nonprofit organizations to enhance joint action to improve cybersecurity.

Rite-Solutions

Rite-Solutions

Rite-Solutions is an award-winning software development, systems engineering, and information technology firm.