Are you giving cyber security the attention it deserves?

Cyber security is a comprehensive multi-faceted approach to identifying, understanding, and then mitigating risks to information systems.

In the past cyber security has largely been seen as a technology issue, left to IT departments to manage. However, with the ever-changing threats and attack methods we’re all facing, IT staff often can’t keep up with cyber security demands.

Most businesses are now unsure of how to protect themselves in an efficient and cost-effective way – or unable to gauge the extent of their real-world exposure. Ensuring you have awareness over your cyber security risks is paramount to keeping businesses safe – and not having this visibility can have serious effects on business practices, profits and viability.

Knowing the risks

Not having adequate cyber security means that you don't have complete visibility over what risks face your organisation.

While your risks will differ depending on the specifics of your business, many businesses focus purely on technology-based solutions, such as:

• Cloud systems such as SaaS and PaaS
• On-premise systems and infrastructure
• Network security
• Antivirus and endpoint products
• Software and product default configurations

These are common and important cyber security measures; however, they are not always addressing the biggest risk to businesses. In fact, recent developments have shown that one of the biggest risks to cyber security is people – particularly employees.

The latest trends in security attacks are sophisticated email phishing scams, and they’re becoming a serious security concern. These techniques trick the user into handing over personal or sensitive details, using this as an entry point to gain access to secure information

Unfortunately, many employees fall for these scams because they aren't trained to be aware of suspicious behaviour. In addition, many business systems aren't hardened against threats or configured in a way that will prevent the phishing emails from coming through. Nor do they limit the effects of a user performing harmful actions. 

Newer security scams are targeting users rather than technology

Without regular monitoring and updating, it can be very easy to find yourself with vulnerable technical systems. Patching systems and managing your system exposure can be time consuming and tedious tasks for in-house IT staff. As a result, it’s often deprioritised and neglected, or at best sporadic – until it’s too late. Our findings following a breach response are often that the incident could have been prevented by ensuring the fundamentals were performed well, rather than buying new and more sophisticated products.

Consequences of poor cyber security

If you experience a security breach, your financial, business, or customer records are compromised. These are serious privacy issues that can be problematic and costly to rectify. Costs to the business can result from:

• Customer dissatisfaction
• Compromised revenue stream
• Significant cost of clean-up

Unfortunately, it doesn’t end there.

There are also a range of legal consequences if your business suffers a breach because of poor cyber security. You could be ignoring your regulatory and compliance obligations, under national and international standards.

Earlier this year there were changes made to The Privacy Act that require new reports about incidents and breaches. This, on top of existing regulations, can see your business subject to:

• Fines to individuals, directors and organisations of up to $2.1 million for companies and $400k for individual directors
• Public breach reports that openly publish all the details of a breach
• Reputational damage
• Failure to keep up with competitors
• Rising cost of compliance and insurance

 Are your cyber security measures protecting you from all angles?

Excusing your excuses

The consequences of not paying attention to cyber security can be severe. So why are there so many businesses out there who are falling short when it comes to optimising their cyber security?

There are two main reasons organisations overlook cyber security:

• Budget - Businesses are aware of the threat of poor security but haven’t properly budgeted to deal with it.
• Naivety - Businesses falsely believe that they have covered their bases and aren’t in need of any further security assessment. In addition, many businesses suffer ‘breach fatigue’ – they are so desensitised to the constant news of breaches that they no longer concerned about their vulnerability.

Many organisations have talented IT teams who are implementing the best systems they can and reporting back that everything that can be done, has been. While this may be true as far as IT abilities go, IT just doesn’t have the expertise across many environments, a view of business rather than technical risk, and the experience cleaning up after a compromise to apply and maintain appropriate security measures.

Risk vs Cost

Businesses who don’t believe they have the budget for cyber security also probably don’t fully appreciate the significant and far-reaching costs of a compromise.

While executing a full security assessment and applying proper measures will come at a cost, the risks of security breach are far higher. When you consider the costs for the immediate response, triage and recovery, potential fines for breaches, and the loss of revenue due to customer dissatisfaction, it’s easy to see why ensuring comprehensive cyber security can be the most cost-effective option.

A well-implemented cyber security program is usually both more economical and more effective than common product-based approaches often installed by IT.

Checking the health of your security

It can be tempting to ignore your cyber security, or palm it off to the IT team. But realistically, both of these options can leave you susceptible to real and damaging risks. Even if your business has been security risk assessed in the past, information security is not a point in time exercise and what was secure yesterday is unlikely to be today.

Undergoing an annual security assessment will increase your visibility of risk and set you up to protect yourself. By placing your business in the hands of a skilled cyber security team, they’ll look beyond the technology and assess all the risks that pertain to your organisation. This will enable you to make confident and proactive decisions about how to proceed to both effectively and pragmatically protect your assets.

Security Centric focus on real-world risks, business-specific threats and the importance of assessing security from all angles – across people, process and technology.

Want to know how your security stacks up? Click here to learn more about assessing your security and discover what risks could be facing your organisation.