COMMENT
According to the report, cyber extortion reached its highest level in early 2023, after a slight decline in 2022. Orange cyber defense, and didn’t slow down for the rest of last year. This year we will probably see more of the same thing.
Cyberattacks on business and industry are increasing in frequency, scope and cost, especially against high-value targets, such as banks, hospitals, utilities and universities, which hold the most sought-after sensitive information in the dark market.
Technology and the sophistication of cybercriminals evolve together rapidly, but many companies and organizations do not. Financially motivated cybercriminals are taking advantage of many victims’ willingness to pay in hopes of quickly restoring network systems and recovering sensitive information.
In this environment, customers, investors, regulatorsand the public will judge brands not only on the security of their networks. They also expect brands to respond to an incident in a transparent, comprehensive and timely manner.
While brands should continue to dedicate resources to the latest defensive technologies, they face growing reputational risk if leadership fails to prioritize strategic incident preparedness and response.
For many business leaders, it’s not about having the will to get started, but rather knowing where to start. Here are four key steps brands should take to strengthen their cybersecurity strategy.
Elevate cybersecurity to senior management and the board of directors
Too many corporate boards of directors delegate cybersecurity responsibilities to the Chief Information Security Officer (CISO) and the IT department. Without leadership involvement, the consequences range from incomplete levels of defense to more costly incident responses, both financially and reputationally.
It is wise for boards to change their view of cybersecurity and incident response, creating a culture in which they are strategic priorities. Rather than being simply another IT expense, they are seen as essential investments to preserve your most valuable assets and protect your credibility with stakeholders.
Start by requesting regular briefings for all directors, detailing network security improvements, adherence to best practices and the latest industry trends. Use this opportunity to discuss tough questions, like how cyber threats are detected or how much it would cost your business if it were completely offline for a week.
Boards should also have an IT committee equivalent to corporate governance, audit or compensation committees. The cyber committee is responsible for assessing your company’s risk profile, establishing a robust cybersecurity policy, and determining what resources, including personnel, are needed to reduce vulnerability.
Check sensitive information
Surprisingly, many organizations do not have complete visibility into what sensitive information they have or where it is stored, much less how it could be compromised or exploited by cyber threat actors.
The first task of the council’s new IT committee is to establish a consistent cadence of rigorous checks and evaluations. For the same reason you check all doors are locked before you go to sleep, regular IT checks help keep you safe. Knowing vulnerabilities, gaps or weak points shows you how and where to add another layer of security.
Update (or create) your incident response plan
An incident response plan is like insurance. You hope you never have to use it, but when you do, you’re grateful to have it.
An incident response plan is a manual or toolkit that guides you through the short- and long-term consequences of an attack. It allows you to act quickly and strategically, protecting your profits and reputation.
While it’s best to customize the plan to your organization, all incident response plans have common elements: Decision protocols clearly define roles and responsibilities. Scenario planning articulates the steps to take for various types of attacks. Stakeholder and media mapping identifies key internal and external audiences and statements enable communication with each when deemed appropriate. Your plan should also identify potential third-party legal, forensic and communications partners, detailing the expertise of each.
Revisit cyber hygiene training
While the data is difficult to track, some reports indicate that insider threats account for up to 60% of cyber incidents. Insider threats can come from a disgruntled employee with malicious intent, but they are often the result of human error.
For example, many employees are in the habit of using free Wi-Fi in cafes, restaurants and other public spaces while using a laptop, tablet or work phone. Because it is unsecured, public Wi-Fi is a breeding ground for attackers. Hackers can steal passwords and other sensitive information or install malicious software on an unsuspecting employee’s device, which eventually finds its way into the main network.
Leadership should frequently review their company’s cyber hygiene training programs, ensuring they are up to date and address identified weaknesses.
Protect your brand reputation and assets
If not handled properly, cyber and ransomware attacks cost more than the potential loss of data or money. Taking these steps can help avoid loss of trust, credibility and reputation, additional costs that can take months or years to recover.