Taking ownership of cyber – it involves us all

 

boardroom1

New research by BAE Systems of 984 IT managers and 221 executives from Fortune 500 companies across the world, has found that there is still a damaging gulf in the perception of who should take charge to manage the aftermath of a cyber-attack in an organisation.

• The survey suggested that 50% of IT staff believed boardroom executives should take the lead when it comes to deciding how a company should respond and repair after it has been penetrated by hackers.
• In contrast, more than 30% of Chief Executives said that IT staff should be the ones cleaning up, fixing problems and hardening defences.

This, according to Dr Adrian Nish, head of the cyber-threat intelligence unit at BAE Systems, could lead to organisations not being prepared for oncoming attacks.

Cost of attack
There was also a mismatch when it came to the perceived cost of a breach:  technology bosses believed that, on average, a breach could cost a company about $19m (£15m).  This estimate included fines, legal fees, remediation expenses and compensation for customers.  By contrast, boardroom members put an average price tag of $11.6m (£9.2m) on breaches.

Prevention much better than cure
Ultimately, whatever the price of a cyber-attack, unless organisations have taken the necessary preventative steps, they remain highly vulnerable to not only the cost of breach, but the enormous impact of reputational damage and loss of trust.

Oliver Parry, head of corporate governance at the Institute of Directors commented:   “As with other principle risks to a business, responsibility of outlining this strategy should fall with the board.  Lasting cybersecurity only comes from embedding good practice throughout the culture of an organisation, starting from the top. No system or person alone can prevent indefinitely the threat of a cyber-attack.”

This ties in with one of the main recurring themes for Amicus ITS’ Director of Technology, Security & Governance, JP Norman, who has stated many times over recent years that good education and awareness by staff (the “squidgy bits”) around data security remains central to good defence efforts in thwarting a successful attack.  Commenting recently

“At Amicus ITS we carry out a 3 stage review on a monthly basis with data being collated via our support functions, reviewed at a formal Information Security Committee meeting and further reviewed at every Board Meeting. This enables us to ensure strategy, training and new developments flow in both directions across our company” JP NormanDirector of Technology, Security & Governance.