FEATURE | Cyber Security
The working assumption should be that every company has suffered multiple security incidents in the last year and those that say ‘not me’ just don’t have the monitoring in place to detect it
WHAT SPECIFICALLY SHOULD THE FINANCE DIRECTOR BE DOING? The most useful thing the FD can do is to define the corporate risk appetite. Ultimately, the board (or the management) of the company is there to take risks to make itself or its shareholders a return on investment. Unfortunately, in most organisations, that risk stance, and thus the risk appetite, is not communicated to those responsible for security. This results in either: little happening (‘it will never happen to me’ scenario); or security trying to protect everything to the Nth degree (the security says ‘NO’ scenario). What we need to achieve is a happy medium – that the information security spending is commensurate with the risk appetite of the board, and that risk appetite is understood and approved by the board.
WHAT QUESTIONS SHOULD THE FINANCE DIRECTOR BE ASKING THEMSELVES? Those engaging in corporate finance activities should ask themselves some simple questions about the cyber-security. These are not limited to, but may include: 5 When did our board last consider cyber-security?
5 Who is ultimately responsible for managing cyber-security in the company?
5 Is that person senior enough to be able to effect the changes necessary?
5 When is the last time I spoke to them (not just asked for a report or presentation)?
5 Do we know what our critical data and systems are?
5 Do we agree with IT/information security’s assessment and/or logic?
5 Does it match our risk-appetite? 5 How confident is the company that its most valuable information is being properly managed and is safe from cyber-threats?
5 When did the company last experience a cyber or information security breach?
5 What steps were taken to mitigate the impact of this breach?
WHAT QUESTIONS SHOULD THE FINANCE DIRECTOR BE ASKING THE SECURITY TEAM? Having briefed the security team on the company’s risk, appetite and business objectives you may want to ask them:
5 What are the critical systems and key data locations within the company? [And then review and agree it with them]
5 In particular, where do we hold data that is personal information, customer information or data liable to any industry regulation? [Data Protection Act, FSA, PCI, HIPAA etc.]
5 What percentage of our data is backed up (including laptops and mobile devices) and how would we survive a ransomware attack?
5 Are all patches applied on our key systems? How is this verified? [Automated scanning for vulnerabilities is a cheap and easy solution, and a good metric]
5 How are we training our staff (and the board) to spot and avoid phishing attacks and achieve a basic level of IT hygiene?
IN CONCLUSION You will be breached - there is no such thing as perfect security, and no silver bullet or magic appliance you can buy. Good information security starts by getting the basics right; do you understand where your data is and its criticality to the business (keeping it confidential and making sure it’s available to those needing to access it)? What you spend on achieving the
level of protection that matches your organisation’s risk appetite should be an ongoing and reasonably frequent discussion, backed up by simple metrics that make sense to your organisation. As your maturity grows, and only if the ROI demands it, should you implement the latest flashy (and oſten very expensive) security tools; in the meantime start simple – automated vulnerability analysis is where I would start, and only when all systems and applications are kept patched and up- to-date (and have the metrics to prove it) should you be signing off increased spending. Q
Paul Simmonds is chief executive of the Global Identity Foundation. He was formerly the global CISO of AstraZeneca, and prior to that was global CISO of ICI. He sits on the advisory board of a number of global companies, as well as the executive advisory board of ISSA UK
DIRECTOR OF FINANCE
35
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52