Top Five Most Common Gaps In Businesses’ Cyber Security

The finding that two in five UK companies have faced cybersecurity attacks in the last twelve months, coupled with the growing availability of tools to simplify hacking, is making business leaders nervous. Operational cybersecurity vulnerabilities are common across the board. There is no escaping the threat, whether you’re in the financial, industrial, education, or power sectors, every industry is at risk.

Knowing where your systems are vulnerable is the first step to protecting them. To gain these insights, a comprehensive assessment and analysis is needed to reveal cybersecurity gaps. From our own analysis, we have found there are some gaps that crop up in almost every business.

Understanding The Enemy

Firstly, and possibly most obviously, cybersecurity starts with understanding the risks. Communicating current security risks to the entire workforce is a primary step in securing a business, and often the simplest gap to fill in a company’s protection.

For example, an increase in remote monitoring and third-party access has also led to a rise in cyber vulnerabilities. The IoT connected devices that have enabled so many businesses to quickly transition to homeworking bring challenges along with their benefits. These tools have essentially increased the ‘attack surface’ for hackers and, in many cases, have acted as an organisation’s Achilles heel.

In most cases, cybersecurity professionals have less than a week to ensure that remote systems were secured before making the shift to remote working, it’s fair to say that the preparation for remote-access related security threats is far from mature in most cases. However, companies must now be taking stock of the new technology they have implemented. Building an awareness of the current risks is the first step in mitigating them.

Holistic Protection

In many cases, people are the first and last lines of protection. So collaboration between teams, including higher management, is essential. However, a common gap in a business’ security is caused by a disconnect between teams, particularly between management and operations.

Embedding cybersecurity into your operations takes the whole enterprise – everyone, everywhere – to understand and accept their own responsibility for cybersecurity. In particular, this means bringing IT and OT together so they can help the entire organisation – not just an area, a function or individual team – be as secure as possible.

Establishing this “we” culture helps to connect the dots across the enterprise, fill gaps and maintain always-on vigilance. This change starts from the top. Employees and vendors, at any level of seniority, need to be aware of and compliant with security policies. This ‘all-in’ approach is what will garner more thorough and consistent commitment to the cybersecurity initiative throughout the organisation.

Understanding Your Assets

Many cyberattacks are successful because employees have caused unintended errors. It is important that staff are aware of, and vigilant against, cyberthreats. This doesn’t just mean blanket, company-wide training on how to spot a phishing email, but also establishing the specific threats associated with the assets under an employee’s care. These could include specific protocols around the use of passwords, policies around WiFi access or regular auditing of user accounts and permissions.

This gap has been especially prominent over the past year. During periods of heightened activity or business restructuring, as personnel move into a new work environment, businesses are even more vulnerable to threats and attacks. 

Before attempting any reorganisation, companies need to consider the types of data and technology they require the reallocated workforce to use. Assigning new or inexperienced workers to different roles requiring the use of unfamiliar technology is always a risk, which is amplified when malicious activity is on the rise. During a crisis, it’s a dangerous combination that could open the door to attacks. 

Preparation Is Key

When it comes to cyberattacks, you can never be too prepared. Implementing proactive, tested incident response and risk mitigation plans which are documented and tested, are an essential step in minimising risk and strengthening customer assurance. A security-aware environment should audit and enforce cybersecurity best practices on a consistent and effective basis, utilising available supervision and detection tools, so that exposure to threats is as limited as possible.

However, in terms of risk mitigation, companies tend to deal with what they perceive to be high-probability, disruptive events that are most likely to occur and can be planned for. However, this is only one part of the bigger picture.

Business Continuity Plans need to also consider events that can disrupt entire industries or, in extreme cases, the global market, such as natural disasters or financial crises and pandemics. While these events are low probability, when they do occur, they can change the assumptions made in all other risk planning – causing gaps in protection capabilities if not properly mitigated.

Limited Capabilities

When it comes to cybersecurity, many companies are very conservative – sometimes for good reason – but that needs to change. A collaborative approach that draws on the expertise, capabilities and visibility of all parties is the key to closing these gaps and achieving fully mature cybersecurity for a business.

Most business leaders do not, unsurprisingly, have the knowledge and experience to enact a cybersecure business strategy. That is why collaborating with skilled and certified professionals, who can provide vendor-agnostic services to help assess an individual business’ risk, implement cyber-specific solutions, and maintain those defences over time, is vital to ensuring no gaps in your armour are left unattended to.

Fully mature cybersecurity is not a destination, it’s a journey, and one that effects the entire organisation. Therefore, there is no quick fix that can be completed over night. It is an ongoing and accumulative process, but, if conducted correctly, it can be of significant benefit to a business, and not a burden.

About The Author: Victor Lough is Cyber Security & Advanced Digital Services Business Lead at Schneider Electric.

You Might Also Read: 

Managing Cyber Security As Office Work Resumes:

 

« Your Organisation Needs A Cyber Audit
Why You Should Never Use A Free Proxy »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

The Hacker News (THN)

The Hacker News (THN)

THN is a leading source for Information Security, Hacking News, Cyber Security, Network Security with in-depth technical coverage of issues and events

ForeScout Technologies

ForeScout Technologies

ForeScout delivers pervasive network security by allowing organisations to continuously monitor & mitigate security exposures & cyberattacks.

Kount

Kount

Kount's “decision engine” platform is ideal for managing fraud in online/telephone channels that process payments and onboard new customers.

Thomas Miller Specialty

Thomas Miller Specialty

Thomas Miller Specialty is a commercial Managing General Agency providing specialty risks insurance including Cyber & e-crime insurance.

BitSight Technologies

BitSight Technologies

BitSight transforms how companies manage information security risk with objective, verifiable and actionable Security Ratings.

NEC

NEC

NEC offers a complete array of solutions to governments and enterprises to protect themselves from the threats of digital disruption.

Asoftnet

Asoftnet

Asoftnet are specialists in IT security, IT forensics, IT service, websites, applications and mobile solutions.

eCosCentric

eCosCentric

eCosCentric provides software development solutions for the IoT, M2M & embedded systems market.

Cyber Defence Solutions (CDS)

Cyber Defence Solutions (CDS)

Cyber Defence Solutions is a cyber and privacy Consultancy with extensive experience in the development and implementation of cyber and data security solutions to your assets.

Sentrium Security

Sentrium Security

Sentrium is committed to helping organisations protect their technology, information and people. Our range of bespoke services provide solutions to tackle a broad range of cyber security challenges.

NGN International

NGN International

NGN International is a full-fledged systems integrator and managed security services provider established in 2015 in Bahrain.

Guidepost Solutions

Guidepost Solutions

Guidepost Solutions are a diverse, global team of investigators, experienced security and technology consultants, and compliance and monitoring experts.

Prancer

Prancer

Prancer is the industry's first cloud-native, self-service SAAS platform for automated security validation and penetration testing in the cloud.

Capgemini

Capgemini

Capgemini is one of the world's foremost providers of consulting, technology and outsourcing services. Areas of expertise include Cybersecurity.

Socura

Socura

Socura helps make the digital world a safer place; changing the way organisations think about cyber security through a dynamic, innovative, and human approach.

Reaktr.ai

Reaktr.ai

Reaktr.ai is founded on the vision of using AI as a catalyst to propel industries into a future where we redefine what's possible. Fortify your cybersecurity defense with our AI-powered platform.