Top Five Most Common Gaps In Businesses’ Cyber Security

The finding that two in five UK companies have faced cybersecurity attacks in the last twelve months, coupled with the growing availability of tools to simplify hacking, is making business leaders nervous. Operational cybersecurity vulnerabilities are common across the board. There is no escaping the threat, whether you’re in the financial, industrial, education, or power sectors, every industry is at risk.

Knowing where your systems are vulnerable is the first step to protecting them. To gain these insights, a comprehensive assessment and analysis is needed to reveal cybersecurity gaps. From our own analysis, we have found there are some gaps that crop up in almost every business.

Understanding The Enemy

Firstly, and possibly most obviously, cybersecurity starts with understanding the risks. Communicating current security risks to the entire workforce is a primary step in securing a business, and often the simplest gap to fill in a company’s protection.

For example, an increase in remote monitoring and third-party access has also led to a rise in cyber vulnerabilities. The IoT connected devices that have enabled so many businesses to quickly transition to homeworking bring challenges along with their benefits. These tools have essentially increased the ‘attack surface’ for hackers and, in many cases, have acted as an organisation’s Achilles heel.

In most cases, cybersecurity professionals have less than a week to ensure that remote systems were secured before making the shift to remote working, it’s fair to say that the preparation for remote-access related security threats is far from mature in most cases. However, companies must now be taking stock of the new technology they have implemented. Building an awareness of the current risks is the first step in mitigating them.

Holistic Protection

In many cases, people are the first and last lines of protection. So collaboration between teams, including higher management, is essential. However, a common gap in a business’ security is caused by a disconnect between teams, particularly between management and operations.

Embedding cybersecurity into your operations takes the whole enterprise – everyone, everywhere – to understand and accept their own responsibility for cybersecurity. In particular, this means bringing IT and OT together so they can help the entire organisation – not just an area, a function or individual team – be as secure as possible.

Establishing this “we” culture helps to connect the dots across the enterprise, fill gaps and maintain always-on vigilance. This change starts from the top. Employees and vendors, at any level of seniority, need to be aware of and compliant with security policies. This ‘all-in’ approach is what will garner more thorough and consistent commitment to the cybersecurity initiative throughout the organisation.

Understanding Your Assets

Many cyberattacks are successful because employees have caused unintended errors. It is important that staff are aware of, and vigilant against, cyberthreats. This doesn’t just mean blanket, company-wide training on how to spot a phishing email, but also establishing the specific threats associated with the assets under an employee’s care. These could include specific protocols around the use of passwords, policies around WiFi access or regular auditing of user accounts and permissions.

This gap has been especially prominent over the past year. During periods of heightened activity or business restructuring, as personnel move into a new work environment, businesses are even more vulnerable to threats and attacks. 

Before attempting any reorganisation, companies need to consider the types of data and technology they require the reallocated workforce to use. Assigning new or inexperienced workers to different roles requiring the use of unfamiliar technology is always a risk, which is amplified when malicious activity is on the rise. During a crisis, it’s a dangerous combination that could open the door to attacks. 

Preparation Is Key

When it comes to cyberattacks, you can never be too prepared. Implementing proactive, tested incident response and risk mitigation plans which are documented and tested, are an essential step in minimising risk and strengthening customer assurance. A security-aware environment should audit and enforce cybersecurity best practices on a consistent and effective basis, utilising available supervision and detection tools, so that exposure to threats is as limited as possible.

However, in terms of risk mitigation, companies tend to deal with what they perceive to be high-probability, disruptive events that are most likely to occur and can be planned for. However, this is only one part of the bigger picture.

Business Continuity Plans need to also consider events that can disrupt entire industries or, in extreme cases, the global market, such as natural disasters or financial crises and pandemics. While these events are low probability, when they do occur, they can change the assumptions made in all other risk planning – causing gaps in protection capabilities if not properly mitigated.

Limited Capabilities

When it comes to cybersecurity, many companies are very conservative – sometimes for good reason – but that needs to change. A collaborative approach that draws on the expertise, capabilities and visibility of all parties is the key to closing these gaps and achieving fully mature cybersecurity for a business.

Most business leaders do not, unsurprisingly, have the knowledge and experience to enact a cybersecure business strategy. That is why collaborating with skilled and certified professionals, who can provide vendor-agnostic services to help assess an individual business’ risk, implement cyber-specific solutions, and maintain those defences over time, is vital to ensuring no gaps in your armour are left unattended to.

Fully mature cybersecurity is not a destination, it’s a journey, and one that effects the entire organisation. Therefore, there is no quick fix that can be completed over night. It is an ongoing and accumulative process, but, if conducted correctly, it can be of significant benefit to a business, and not a burden.

About The Author: Victor Lough is Cyber Security & Advanced Digital Services Business Lead at Schneider Electric.

You Might Also Read: 

Managing Cyber Security As Office Work Resumes:

 

« Your Organisation Needs A Cyber Audit
Why You Should Never Use A Free Proxy »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

RIVA Solutions

RIVA Solutions

RIVA provides innovative best practices in IT and management consulting, program support services and emerging technologies.

Cypress Semiconductor

Cypress Semiconductor

Cypress is a semiconductor design and manufacturing company providing embedded devices for secure IoT applications.

CERT-IS

CERT-IS

CERT-IS is the national Computer Emergency Response Team for Iceland.

Finnish Information Security Cluster (FISC)

Finnish Information Security Cluster (FISC)

FISC is an organization established by major Finnish information security companies to promote their activities nationally and internationally.

Computest

Computest

Computest security testing services include Mobile app security, Vulnerability assessments, Attack & penetration testing, Security awareness training, Network security assessments.

Armorblox

Armorblox

Armorblox stops targeted email attacks such as 0-day credential phishing, payroll fraud, vendor fraud, and other threats that get past legacy security controls.

Dcode

Dcode

Dcode connects the tech industry and government to drive commercial innovation in the federal market.

PreCog Security

PreCog Security

PreCog Security is a US based cybersecurity risk mitigation company. We specialize in helping you find, minimize and manage vulnerability risk within your product, network and process.

Dazz

Dazz

Dazz is the cloud security remediation platform for smart security and development teams.

Accedian

Accedian

Accedian is a leader in performance analytics and end user experience solutions, dedicated to providing our customers with the ability to assure their digital infrastructure.

Advantage

Advantage

Advantage exists to provide peace of mind in an evolving technology reliant world. We were created by visionaries who for nearly 4-decades have been passionate about providing world-class solutions.

Winmill Software

Winmill Software

Winmill is a technology services company that provides expert consulting services in Application Development, Application Security and Cyber Security.

Maintel

Maintel

Maintel provides cloud and managed communications services. We help our customers to deliver exceptional customer experiences, and to securely access their applications and their data.

ExchangeDefender

ExchangeDefender

ExchangeDefender provides cybersecurity services that secures your company email and data, and guarantees 24/7 email access.

Spera Security

Spera Security

Spera helps identity security professionals effectively and confidently measure, prioritize and reduce identity risk to better protect the organization from identity-based attacks.

Cynical Technology

Cynical Technology

Cynical Technology is a Nepalese cybersecurity company with expertise in security consulting, auditing, testing and compliance.