Cyber Security: Looking beyond
Technology
People, processes, policy and culture are crucial elements of effective cyber security
anticipate,” a recent Symantec report, which discusses the latest trends in the Threat landscape, has disclosed. Traditional cyber security defences such as anti-virus (AV) and firewalls no longer possess the capabilities to protect our personal data against advanced threats. While traditional technologies are becoming redundant, threat patterns and behaviours grow stronger.
“
A holistic approach to cyber security will both raise cyber resilience within organisations and deliver competitive advantage. Andrew Fitzmaurice, Chief Executive of Templar Executives, believes, “more sophisticated and coordinated attacks on the internet of things are on the horizon. Open-source codes which are widely available and free to access from the internet will also feature on threat analysts ‘watch-list’ as a key source of data breaches. To withstand these threats, it is vital businesses and organisations grow their cyber resilience”. He adds, “The best solution for businesses to protect their information will emphasise holistic cyber security. This encompasses people, processes, policy and culture supported by IT.”
Moreover, traditional defences such as AV and firewalls are failing because of pre- existing weaknesses inside ‘the castle walls’. Regardless of malicious intent or otherwise, human weakness is a fact of life.
“A survey of information security breaches by the Department for Business, Innovation and Skills highlights that people are the weakest links in the chain,” says Fitzmaurice. “It found that 58 per cent of large organisations and 22 per cent of small businesses suffered staff- related security breaches in 2014. It is important for businesses to realise the need
© CI TY S ECURI TY MAGAZ INE – SUMMER 2015
Cyber-attacks are leapfrogging defences in ways companies lack insight to
to be proactive, rather than reactive, in order to protect themselves against the coming years’ threats.”
6. 5.
4. 3.
2. 1.
The bypassing of company security policies, such as emailing confidential business information to personal email accounts, is a symptom of an organisation which is not ‘business enabling’. Similarly, employees need to recognise and know how to mitigate against malicious intent or activities, such as Social Engineering or Phishing.
Training is critical to raise awareness and understanding of the importance of good cyber security practice. Policies are often set and communicated without follow-up employee engagement. Leaders need to ‘finish the conversation’; explain why these policies are important, in a way that everyone in the organisation understands and is able to apply relevance to their role and the business.
Individuals need to know their accountability, and the consequences of ignorance, breach or complacency. In recent news stories, examples of consequences to businesses include crippling financial fines, loss of IPR, business disruption and damage to reputation. Added to this, future penalties for data breaches will include jail terms for all those deemed accountable.
Engagement, Training and Awareness are essential to build a culture that protects, values and safely exploits information and optimises business objectives and reputation. The need to introduce proactive, preventative measures rather than a reactive ‘patch’ approach is vital for survival in this space. Leadership is key and measures need to proportionate and appropriate. Board
www. c i t y s e cur i t yma ga z ine . com
6. Culture 5. Governance & Board-Level Ownership 4. Strategy 3. Information Risk Management 2. Identify Critical Information 1. Business Outcomes
members need to be exemplars and upskill to develop their own knowledge and capabilities. Ensuring all employees receive the right training at the right time will help foster a culture in which good information assurance becomes ‘business as usual’. Enablers to ensure this is the established norm include: communication, management practices and organisation levers such as performance management and reward.
Organisations which demonstrate real cyber maturity will incorporate training into all aspects of business life, from the induction process to the exit interview. Employees will also reap the added value of being able to apply this learning to everyday life. Due to the interconnected nature of business, mature organisations will need to extend key messaging and knowledge sharing to their third party suppliers and contractors, in order to prevent supply chain vulnerabilities.
Companies who are able to demonstrate that they look after information will ultimately add more value to their business. This can be translated positively to the bottom line - they are more likely to deliver competitive advantage, win business contracts with the UK Government, as well as in the private sector. In addition this will enhance business reputation, customer and investor confidence, leading to increased brand value and share price.
Andrew Fitzmaurice Chief Executive Templar Executives
www.templarexecs.com
> 19
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36