Top five most common gaps in businesses’ cybersecurity
Author : Victor Lough, Cyber Security & Advanced Digital Services Business Lead, Schneider Electric
21 May 2021
The finding that two in five UK companies have faced cybersecurity attacks in the last twelve months, coupled with the growing availability of tools to simplify hacking, is making business leaders nervous. Operational cybersecurity vulnerabilities are common across the board. There is no escaping the threat, whether you’re in the financial, industrial, education, or power sectors, every industry is at risk.
Knowing where your systems are vulnerable is the first step to protecting them. To gain these insights, a comprehensive assessment and analysis is needed to reveal cybersecurity gaps. From our own analysis, we have found there are some gaps that crop up in almost every business.
Understanding the enemy
Firstly, and possibly most obviously, cybersecurity starts with understanding the risks. Communicating current security risks to the entire workforce is a primary step in securing a business, and often the simplest gap to fill in a company’s protection.
For example, an increase in remote monitoring and third-party access has also led to a rise in cyber vulnerabilities. The IoT connected devices that have enabled so many businesses to quickly transition to homeworking bring challenges along with their benefits. These tools have essentially increased the ‘attack surface’ for hackers and, in many cases, have acted as an organisation’s Achilles heel.
With only 16% of cybersecurity professionals having more than a week to ensure that remote systems were secured before making the shift to remote working, it’s fair to say that the preparation for remote-access related security threats is far from mature in most cases. However, companies must now be taking stock of the new technology they have implemented. Building an awareness of the current risks is the first step in mitigating them.
Holistic protection
In many cases, people are the first and last lines of protection. So, collaboration between teams, including higher management, is essential. However, a common gap in a business’ security is caused by a disconnect between teams, particularly between management and operations.
Embedding cybersecurity into your operations takes the whole enterprise – everyone, everywhere – to understand and accept their own responsibility for cybersecurity. In particular, this means bringing IT and OT together so they can help the entire organisation – not just an area, a function or individual team – be as secure as possible.
Establishing this “we” culture helps to connect the dots across the enterprise, fill gaps and maintain always-on vigilance. This change starts from the top. Employees and vendors, at any level of seniority, need to be aware of and compliant with security policies. This ‘all-in’ approach is what will garner more thorough and consistent commitment to the cybersecurity initiative throughout the organisation.
Understanding your assets
Many cyberattacks are successful because employees have caused unintended errors. It is important that staff are aware of, and vigilant against, cyberthreats. This doesn’t just mean blanket, company-wide training on how to spot a phishing email, but also establishing the specific threats associated with the assets under an employee’s care. These could include specific protocols around the use of passwords, policies around Wi-Fi access or regular auditing of user accounts and permissions.
This gap has been especially prominent over the past year. During periods of heightened activity or business restructuring, as personnel move into a new work environment, businesses are even more vulnerable to threats and attacks.
Before attempting any reorganisation, companies need to consider the types of data and technology they require the reallocated workforce to use. Assigning new or inexperienced workers to different roles requiring the use of unfamiliar technology is always a risk, which is amplified when malicious activity is on the rise. During a crisis, it’s a dangerous combination that could open the door to attacks.
Preparation is key
When it comes to cyberattacks, you can never be too prepared. Implementing proactive, tested incident response and risk mitigation plans which are documented and tested, are an essential step in minimising risk and strengthening customer assurance. A security-aware environment should audit and enforce cybersecurity best practices on a consistent and effective basis, utilising available supervision and detection tools, so that exposure to threats is as limited as possible.
However, in terms of risk mitigation, companies tend to deal with what they perceive to be high-probability, disruptive events that are most likely to occur and can be planned for. However, this is only one part of the bigger picture.
Business Continuity Plans need to also consider events that can disrupt entire industries or, in extreme cases, the global market, such as natural disasters or financial crises and pandemics. While these events are low probability, when they do occur, they can change the assumptions made in all other risk planning – causing gaps in protection capabilities if not properly mitigated.
Limited capabilities
When it comes to cybersecurity, many companies are very conservative – sometimes for good reason – but that needs to change. A collaborative approach that draws on the expertise, capabilities and visibility of all parties is the key to closing these gaps and achieving fully mature cybersecurity for a business.
Most business leaders do not, unsurprisingly, have the knowledge and experience to enact a cybersecure business strategy. That is why collaborating with skilled and certified professionals, who can provide vendor-agnostic services to help assess an individual business’ risk, implement cyber-specific solutions, and maintain those defences over time, is vital to ensuring no gaps in your armour are left unattended to.
Fully mature cybersecurity is not a destination, it’s a journey, and one that effects the entire organisation. Therefore, there is no quick fix that can be completed over night. It is an ongoing and accumulative process, but, if conducted correctly, it can be of significant benefit to a business, and not a burden.
Contact Details and Archive...