Business Leaders Can Make Big Mistakes About Cyber Security

The past two years of Coronavirus been very challenging for many businesses, both large and small. Some had to close their offices and rapidly convert the workforce to remote working for their employees, pushing through frequently incomplete digital transformation strategies to make it happen as quickly as possible.

Many of these business discovered that protecting their operations from from cyber threats suddenly became much more urgent and business leaders were hard -pressed to get up to speed in understanding and dealing with their organization' heightened level of cyber risk.

Today, every business needs to address cyber security to operate in the online world and regardless of the size of the business, the reality is that cyber security is not just the domain of security professionals or its executives. Every single employee within a company has a hand in the protection of the business, as they handle company data, manipulate it, and communicate it as part of their jobs.

Business leaders must trust their employees with sensitive data to ensure they can effectively do their jobs. But a data breach involving sensitive board information can result in costly litigation and devastate an organisation’s reputation. Cyber criminals are acutely aware of the gateway that employees create for malicious activity. This is evidenced by the fact that long weekends and public holidays are the preferred time for cyber criminals to attack, as IT staff are unlikely to be monitoring activity, making it more difficult for companies to react quickly.

At the same time, company Boards and Senior Executives have experienced a much higher level of personal jeopardy, with CEOs forced out of their jobs as a result of inadequate performance when confronted with cyber security issues, like breaches, data loss, heavy ransom demands, reputational damage and often crushing financial consequences.

Although cyber security is now most definitely on the board’s agenda in most organisations, it is rarely a fixed item. More often than not, it makes appearances at the request of the Audit & Risk Committee or after a question from a non-executive director, or in response to a security incident or a near-miss. All this hides a pattern of recurrent cultural and governance attitudes which could be hindering cyber security more than enabling it.

There are three big mistakes the business leaders need to avoid to promote cyber security and prevent breaches.

Downgrading       

Every organisation is different and the COVID crisis is affecting each one differently, but pretending that the protection of the business from cyber threats is not a relevant board topic is both negligent and consequently an issue r of poor governance which non-executive directors have a duty to recognise and and address.

• Cyber attacks are in the news every week and have been the direct cause of millions in direct losses and hundreds of millions in lost revenues in many large organisations across almost all industry sectors. 

• Data privacy regulators have suffered setbacks in 2020: They have been forced to adjust down some of their fines, and we have also seen a first successful challenge in Austria leading to a multi-million fine being overturned. Regulatory fines are now becoming very costly, potentially reaching 4% of global turnover under GDPR regulations and the risks should certainty register with most company boards.

• The Coronavirus crisis has made most businesses heavily dependent on digital services, the stability of which is built on sound cyber security practices, in-house and across the supply chain. Cyber security has become as pillar of the “new normal” and even more than before, should be a regular board agenda, clearly visible in the portfolio of one member who should have part of their remuneration linked to it. 

Treating It As Exclusively An IT Problem     

This is a dangerous mistake to make at a number of levels. Cyber security has never been a purely technological matter and the protection of the business from cyber threats has always required concerted action at people, process and technology level across the organisation. Reducing it to a technical issue downgrades the subject, and as a result the calibre of talent it attracts.

• In large organisations it can led to a persistent failure to address cross-silo issues around identity or vendor risk management, in spite of the millions spent on those matters with tech vendors and consultants. It should not be left to the CIO to deal with, unless their profile is sufficiently elevated within the organisation. 

• Alternative organisational models don't necessarily deal with the challenges of the digital transformation and the prioritisation of data privacy, even taking proper account GDPR. It is quite easy, in particular in large firms, to over-engineer the three lines of defence and to build monstrous and inefficient control models. Proper cyber security depends upon trust, and must bring a visible benefit to each part of the control organisation to avoid creating a culture of blame and finger-pointing.

Throwing Money At The Problem        

Protecting an organisation from cyber threats is a mindset that is best ingrained in an organisation's culture, not something you can simply purchase of the shelf. Indeed, most of the breached organisations of the past few years would have spent collectively tens or hundreds of millions on cyber security products over the last decade.

A lack of adequate investment in workforce skills and cybersecurity training  is certainly risky, as IT teams struggle to keep corporate networks operational and secure  when the rise in remote working is adding to their security challenges.

CISOs need to be in communication with the board in order to ensure that they understand  the needs of cyber security and that they are making the right levels  investment, but where the level of cyber security awareness among the workforce is low and a major change in culture and attitude is required, just spending money at the problem is not the answer. It is more important to focus on a providing leadership in building cyber security awareness.

This needs to start at the top of the organisation, with a highly  visible and credible board commitment, that can be promulgated throughout  the organisation.

Technative:      HelpNetSecurity:       Information-Age:    DLA Piper:      ZDNet:     Image: Unsplash

You Might Also Read: 

Cyber Security Is The CEO’s Biggest Problem: