{"id":315,"date":"2021-05-24T11:23:00","date_gmt":"2021-05-24T11:23:00","guid":{"rendered":"https:\/\/pendulum-it.com\/?p=315"},"modified":"2021-05-24T11:23:01","modified_gmt":"2021-05-24T11:23:01","slug":"how-to-ensure-cybersecurity-is-still-a-board-level-concern","status":"publish","type":"post","link":"https:\/\/pendulum-it.com\/how-to-ensure-cybersecurity-is-still-a-board-level-concern\/","title":{"rendered":"How to ensure cybersecurity is still a board level concern"},"content":{"rendered":"\n
\"How<\/figure>\n\n\n\n

In 2021, cybersecurity has to be a visual, prioritised part of every business strategy.
Cybercrime has become industrialised on a scale not seen before and shows no sign of flattening out. Current enterprise spend is around $54bn* globally in 2021 (*source Statista March 2021). In a 2020 report McAfee <\/a>estimated global cybercrime losses to exceed $1 trillion. Discreet malware cases alone in the last 10 years have increased from $99.71m in 2012 to $1214.76m* in 2021 (up until 6th May) (*source AV-Test 2021). <\/p>\n\n\n\n

\n
\n
\n
\"\"<\/figure>\n<\/div>\n\n\n\n
\n

About the Author<\/strong><\/p>\n\n\n\n

Senior Account Manager, Jeffrey Magara helps Global Enterprise & SME clients to deliver consolidating, cost saving IT solutions and projects. <\/p>\n<\/div>\n<\/div>\n<\/div><\/div>\n\n\n\n

Most common cybersecurity threats<\/h2>\n\n\n\n

The sophistication of the cyber threats and their intensity are escalating, amid the swelling levels of remote working and dependence on digital devices. The most damaging forms of cybercrime to enterprises include:<\/p>\n\n\n\n

\u2022 Social engineering <\/strong>
Including phishing emails, scareware and quid pro quo.<\/p>\n\n\n\n

\u2022 Ransomware<\/strong>
The third most popular type of malware used, Ransomware is employed in 22% of instances. In 2020 hackers demanded $1.14 million from The University of California after accessing COVID-19 research and stole 10tb of data from Canon.<\/p>\n\n\n\n

\u2022 DDoS attacks<\/strong>
DDoS (Distributed Denial of Service) can have a devastating effect on businesses with a high reliance on on-line traffic digital services. DDoS attacks have become an increasingly popular threat. Alarmingly there is an increase in DDoS for hire services, which are relatively cheap to engage.<\/p>\n\n\n\n

\u2022 Third party software<\/strong>
It only takes one compromised enterprise applications within the ecosystem to open the gateway for hackers to other domains. <\/p>\n\n\n\n

\u2022 Cloud computing vulnerabilities<\/strong>
Criminals scan cloud services searching for those that have no password, exploiting unpatched systems and performing severe attacks to access the user accounts. These breaches can result in ransomware, theft of data or coordinated DDoS attacks.<\/p>\n\n\n\n

Threats are increasing<\/h2>\n\n\n\n

The unprecedented number of recent infiltrations demonstrates that cybersecurity risk is as significant as other critical strategic, operational, financial and compliance risks under a board\u2019s scope.
Just as boards are charged with overseeing a company\u2019s financial systems and controls, they have a duty to oversee a company\u2019s management of cybersecurity. This includes oversight of appropriate risk mitigation strategies, systems, processes and controls.<\/p>\n\n\n\n

Without effective oversight and accountability, an organisation\u2019s cybersecurity governance systems, policies and procedures are rendered meaningless, leaving the enterprise vulnerable to attack. <\/p>\n\n\n\n

How do you quantify cybersecurity risk?<\/h2>\n\n\n\n

The more an enterprise is dependent on digital devices and services, such as remote working and the cloud in general, the greater the associated risk is, as most threats appear from outside of the organisation than from within.
To quantify where your risks lie and what you stand to lose, auditing your current security capabilities is a good place to start. List your current security capabilities, the programs you have in place and what they are expected to do. By considering the most common forms of cyber threat (mentioned earlier) – how does your current programme address each high-risk scenario you may face?<\/p>\n\n\n\n

Understanding your vulnerabilities<\/h2>\n\n\n\n

Having a very good understanding of your susceptible assets will help you create a vulnerability management plan. The plan most likely will include scans of all appropriate assets. This process should help you understand what specific action you may need to take and might include managing patches and updates. The vulnerability management plan can also feed into your business continuity and DR plans<\/a> to strengthen your resilience. A thorough audit will pay dividends and is likely to uncover areas of \u2018dark data\u2019 within the enterprise, as well as quantifying cybersecurity risk.<\/p>\n\n\n\n

How much should you spend on cybersecurity?<\/h2>\n\n\n\n

Your board will inevitably want to know how much budget to allocate to cybersecurity defences. Some believe 10% of IT budget should be spent on security measures, but this is misleading and an underspend could put your enterprise at risk. Another metric employed by some organisations is a percentage of revenue. This might add more gravity to the potential risk. We recommend spending in-line with the level of exposure and associated risk to cybercrime your enterprise has. Also, to look at it purely on IT budget spend, would severely miss the point. The approach to cyber security should be enterprise-wide rather than fitting into one specific domain.<\/p>\n\n\n\n

What are the new approaches to cybersecurity?<\/h2>\n\n\n\n

It is key to keep the board updated on the latest technologies so they might evaluate the options in an educated way. A threefold demand in cloud services has in part changed the cybersecurity landscape, with new approaches that include:<\/p>\n\n\n\n