Cyber Security Insights For Executives

Business leaders and theit exective teams may see cyber security as the IT departments problem and a priority only when an intrusion occurs, but the cyber threat never stands still. It’s always evolving and criminal groups capitalise on new technologies to identify targets and launch attacks on an industrial scale. If your business has not experienced a cyber attack in the past year, you are in a shrinking minority. 
 
According to a survey carried out by  the Information Systems Security Association (ISSA) 58% of senior cyber security and business managers say that their organisation’s executive level  commitment to cyber security is “very good,” the remaining 42% say that their organisation’s executives’ dedication and buy-in to cyber security is “satisfactory, honest, or poor.” 
 
Cyber Security Topics Executives  Think Are Important  
 
Data privacy -   Data privacy topped the list at 35%, and this makes sense given regulations like GDPR and CCPA. In the past, data privacy was handled by legal teams, but with the onset and growth of regulations, CISOs have been asked to operationalise data privacy.  In other words, security teams are responsible for things like data discovery, the introduction of new data security controls, and coordination around technologies for data deletion.  GDPR also comes with the potential for hefty fines, so executives are paying close attention.  
 
Cyber attacks -  Can affect the interests of all stakeholders, disrupting a company’s operations, affecting how its employees work and inflicting brand damage that can severely jeopardise customer loyalty and trust. A breach can also impact sensitive information related to clients, contractors and suppliers. And as tighter regulations are put in place, companies may be exposed to legal liability, making cyber security a key corporate governance concern for investors.  
 
The threat of cyber attacks is so severe that the World Economic Forum in 2018 declared cyber security the top business risk in Europe, North America, and East Asia and the Pacific. 
 
Continuous cyber security training is lacking  - When asked if their current employer provides the cyber security team with the right level of training to keep up with business and IT risk, more than half (56%) of survey respondents answered “no,” suggesting that their organisations needed to provide more or significantly more training for the cyber security staff.
 
Internal relationships need work -  While many organisations consider the relationship between cyber security, business, and IT teams to be good, it seems that 20% of cyber security professionals say the relationship between cyber security and IT is fair or poor (surprising given that 78% of cyber security professionals got their start in IT) and 27% of survey respondents claim the relationship between cyber security and the business is fair or poor.  The biggest cyber security/IT relationship issue selected relates to prioritizing tasks between the two groups while the biggest cyber security/business relationship challenge is aligning goals.
 
Many businesses still believe they are below the criminals’ radar, however, the growth in cyber crime enabled by automatic vulnerability identification mean that every business is a target. 
 
It’s not the nature of a business that attracts the interest of cyber crime groups. It’s weak defences and the opportunity these present to mount a successful attack.  Your incident response plan should allow you to respond effectively to a range of scenarios, such as an internal breach, external attack, accidental data sharing and loss or theft of a physical device. 
 
Planning For Future Cyber Security Issues:  
 
  • Do you have an incident response plan in place? 
  • Who will lead the incident response team? 
  • What will happen in the first 24 hours after a breach? 
  • Have you allocated enough resources to ensure an effective response? 
  • What external partners will you use to manage elements such as forensic investigation, public relations, legal affairs and the notification process in the event of a data breach? 
Threats from outside the company are a huge concern for cybersecurity teams, but there are significant threats inside company firewalls. 
 
The very people who are closest to the data or other corporate assets can often be a weak link in a company’s cybersecurity program, particularly when they share passwords or files over unprotected networks, click on malicious hyperlinks sent from unknown email addresses, or otherwise act in ways that open up corporate networks to attack. Indeed, threats from inside the company account for about 43 percent of data breaches. 
 
Cyber security must be the concern of every single employee from the CEO down to the receptionist,  because implementing the best cyber security practice isn’t just about firewalls and encryption, it’s about changing the entire culture of your organisation. 
 
Creating a work environment which is vigilant and proactive is the only way to truly protect your business. Although there is no such thing as perfect protection, as a business leader, you have the responsibility to significantly reduce the risks.
 
ISSA:        Grant Thornton:     McKinsey:        Tech Centry:      Chief Executive:      CSO Online:       Image: Unsplash
 
You Might Also Read:
 
Five Things Management Must Know About Cyber Security:
 
 
« Hackers Fail To Contaminate Florida Water
Every Employee Should Be Considered A Target »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Applause

Applause

Applause provides real-world software testing for functionality, usability, accessibility, load, localization and security.

Information-Technology Promotion Agency (IPA) - Japan

Information-Technology Promotion Agency (IPA) - Japan

IPA is an implementing agency in Japan with a role to address Information Security, IT Systems Reliability and IT Resource Development.

Claroty

Claroty

Claroty was conceived to secure and optimize OT networks that run the world’s most critical infrastructures.

OSIRIS Lab - NYU Tandon

OSIRIS Lab - NYU Tandon

The Offensive Security, Incident Response & Internet Security Lab (OSIRIS) is a security research environment where students analyze and understand how attackers take advantage of real systems.

vdiscovery

vdiscovery

vdiscovery is a provider of proprietary and best-in-breed solutions in computer forensics, document review, and electronic discovery.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Global Lifecycle Solutions EMEA (Global EMEA)

Global Lifecycle Solutions EMEA (Global EMEA)

Global EMEA provides full lifecycle services to corporate Clients covering procurement, configuration, support, maintenance and end-of-life asset management.

DataCloak

DataCloak

DataCloak is an innovation company that focus on providing enterprise data-in-motion security solutions based on zero-trust security technology.

Secure Ideas

Secure Ideas

Secure Ideas is focused on penetration testing and application security including web applications, web services and mobile applications.

Mage Data

Mage Data

Mage (formerly Mentis Software) is a leading solutions provider for data security and data privacy software for global enterprises.

Cyware

Cyware

Cyware is the only company building Virtual Cyber Fusion Centers enabling end-to-end threat intelligence automation, sharing, and unprecedented threat response for organizations globally.

Open Source Security Foundation (OpenSSF)

Open Source Security Foundation (OpenSSF)

OpenSSF is committed to collaboration and working both upstream and with existing communities to advance open source security for all.

Liquis Inc.

Liquis Inc.

Liquis, founded in 2002, is one of the largest facility decommissioning services companies in the U.S.

Security Risk Advisors (SRA)

Security Risk Advisors (SRA)

Security Risk Advisors deliver cybersecurity services to leading companies in the Financial Services, Healthcare, Pharmaceuticals, Technology and Retail industries.

Ventum Consulting

Ventum Consulting

Ventum Consulting stands for digitalization, networking and agilization. We take this up on the strategic, professional and technical side and support our customers in the digital transformation.

Winslow Technology Group (WTG)

Winslow Technology Group (WTG)

Winslow Technology Group is a leading provider of IT Solutions, Managed Services, and Cybersecurity Services dedicated to providing exceptional business outcomes for our customers since 2003.