Ci spiace, ma questo articolo è disponibile soltanto in Inglese e Russo.
In the digital world, no business can be sure of its invulnerability. Every company sooner or later faces a cyberattack, but only a few take a business-oriented approach to cyber risks.
A PwC 2020 study found that about 62% of CEOs worldwide worry that cyber threats will affect their companies’ growth potential. Yet, according to Gartner, only 30 percent of organizations are implementing a business approach to cyber risks in their organizations.
Over the past year, many companies have experienced a digital transformation. Cybersecurity now goes far beyond single connected objects and databases. It has become business-critical – capable of saving an organization from reputational and financial losses, downtime, and complete shutdowns. It’s time for everyone to rethink cybersecurity as a strategic business priority, not just an IT solution.
We will never tire of repeating that cybersecurity is an ongoing process, not a single task. It requires a holistic strategy involving people, processes, and technology that integrates security at every level, not just at critical moments. For example, the NIST framework is a guideline for building an end-to-end digital risk strategy that involves multiple layers of security. Let’s take a closer look at three major factors that affect the integrity of the cyber risk approach, as well as identifying and minimizing them:
- People.
Every employee, from the entry-level to the executive, must clearly understand the consequences of cyberattacks, know how the security practices are intertwined with business processes, and receive periodic training. Companies must cultivate a culture of cyber resilience and pay more attention to identifying potential insider threats.
- Process.
A cyberattack has occurred. What should you do? That is where it’s critical to follow a recovery plan. Get as much information about the incident as you can then share it with your colleagues, including partners, customers, and authorities. By disclosing information, even if the incident was not your fault, you will eliminate several risks and build stakeholder trust.
Don’t forget that you can protect yourself while you’re still building relationships with partners. Request security certifications, and make sure that a cybersecurity approach is taken at all stages of the process.
- Technology.
Ideally, any technology solutions (R&D ecosystem, global supply chain, etc.) should be based on secure engineering. That allows companies to adapt, address and identify vulnerabilities quickly. With this approach, care must be taken both at the product and system level, as a perfectly secure product can become a threat if used in an insecure system. Imagine the situation that you found a crack in a building. To fix it you need to start with the basement itself. Likewise, if you don’t consider the safety of the product at the beginning, you have to go back to the basics to fix it. And that’s a costly undertaking.
Source: Industryweek
