Preparation begins with the C-Suite as cybercrime syndicates go global
The pace and scale of information security threats continues to accelerate, endangering the integrity and reputation of today’s most trusted organizations. Businesses are struggling to cope with the quantum speed and sophistication of global cyber-attacks being carried out by organized cyber-criminal syndicates.
Moving forward, businesses need to prepare to be targeted at any time, and any place, by multiple assailants. Organizations that wish to keep pace with these developments, and remain financially viable, need to take action now, or face the consequences. With the speed and complexity of the security threat landscape changing on a daily basis, those organizations that don’t prepare will be left behind, most likely in the wake of reputational and financial damage.
According to the Ponemon Institute’s 2015 Cost of Data Breach Study, the average consolidated total cost of a data breach is $3.8 million. The study also found that the cost incurred for each lost or stolen record containing sensitive and confidential information increased six percent from a consolidated average of $145 to $154. Ponemon also found that 47 percent of all breaches in this year’s study were caused by malicious or criminal attacks and the average cost per record to resolve such an attack is $170. In contrast, system glitches cost $142 per record and human error or negligence is $134 per record.
Reducing the Risk of Attack
Today, risk management largely focuses on achieving security through the management and control of known risks. The rapid evolution of opportunities and risks in cyberspace is outpacing this approach and it no longer provides the required protection. Cyber resilience requires recognition that organizations must prepare now to deal with severe impacts from cyber threats that are impossible to predict. Organizations must extend risk management to include risk resilience, in order to manage, respond and mitigate any negative impacts of cyberspace activity.
Cyber resilience also requires that organizations have the agility to prevent, detect and respond quickly and effectively, not just to incidents, but also to the consequences of the incidents. This means assembling multidisciplinary teams from businesses and functions across the organization, and beyond, to develop and test plans for when breaches and attacks occur. This team should be able to respond quickly to an incident by communicating with all parts of the organization, individuals who might have been compromised, shareholders, regulators and other stakeholders who might be affected.
Cyber resilience is all about ensuring the sustainability and success of an organization, even when it has been subjected to the almost inescapable attack. By adopting a realistic, broad-based, collaborative approach to cyber security and resilience, government departments, regulators, senior business managers and information security professionals will be better able to understand the true nature of cyber threats and respond quickly and appropriately.
Have Standard Security Measures in Place
Business leaders recognize the enormous benefits of cyberspace and how the Internet greatly increases innovation, collaboration, productivity, competitiveness and engagement with customers. Unfortunately, they have difficulty assessing the risks versus the rewards. One thing that organizations must do is ensure they have standard security measures in place.
In preparation for making your organization more cyber resilient, here is a short list of next steps that I believe businesses should implement to better prepare themselves:
- Focus on the Basics
o That Includes People and Technology
o Adopt Policies and Procedures to Engage
- Prepare for the Future
o Be Ready to Support New Business Initiatives
o Align Security with Risk Management
- Change your Thinking About Cyber Threats
o Think Risk and Resilience
- Re-assess the Risks to Your Organization and its Information from the Inside Out
o Inside and Outside the Organization
o Share Intelligence
- Revise Information Security Arrangements
o Collaborate and Share Insight
o Understand Your Vulnerabilities
Organizations of all sizes need to ensure they are fully prepared to deal with these ever-emerging challenges by equipping themselves to better deal with attacks on their business as well as their reputation. It may seem obvious, but the faster response you have, the better your outcome will be.
About the Author
Steve Durbin is Managing Director of the Information Security Forum (ISF). His main areas of focus include strategy, information technology, cyber security and the emerging security threat landscape across both the corporate and personal environments. Previously, he was senior vice president at Gartner.
