The New Rules Of Cybersecurity

The hardest one, and the one that concerns me the most, is the integrity of the data. What happens when an attacker is able to change your data and you don’t know it’s been changed? Today, all our systems depend on data and if you can no longer trust the integrity of the data, you have a significant problem. In my view, that’s the most dangerous threat we face in the future and one you need to prepare for today.

8. Get a Second Opinion. Second opinions matter—be careful of group-think. Bring in outside experts. It’s great to confirm your ideas, but it is even more valuable to get fresh thoughts and ideas from outside your organization.

9. Practice, Practice, Practice. If you do nothing else, prepare for a breach and be ready to respond. The best way to be ready is to train over and over and over again. Everything depends on it—your company value, your reputation. Have a strong incident response plan, have it reviewed and updated routinely, and most significantly, rehearse it, with internal and external participants, until everyone knows what’s required if they have to respond. I’m sure it won’t go as planned, but I can guarantee everyone will be ready to adjust as needed.

10. Keep Asking Questions. The last thing is to be engaged and keep asking questions. When I started cyber command, the only thing I knew was that I had a lot to learn. I counted on my experts to help inform me on what I needed to know, and I talked to a lot of outside people to get their views. Then, it was important to move quickly beyond the basics and to ask tough questions in order to close the gap between your expectations and reality.

Get engaged, as opposed to saying, “Well, that’s the cybersecurity people, or that’s IT, or that’s not important to me.” That doesn’t send the right message, and it doesn’t allow you to do the necessary strategic thinking and work required to appreciate what needs to be done to protect your business—and to ensure your mission.

THE KEY QUESTIONS TO ASK

Why would they attack us?
What are our crown jewels and where are they; who can access them; how do we know they’re protected?
How do we know threats are not in our network?
What are our most significant vulnerabilities and risks?
Do we have a framework to address cybersecurity and to ensure hygiene?
Do we have a culture of cyber-risk awareness and is the policy for personal responsibility and accountability clear?
Do we have visibility across our supply chain and is cybersecurity built into our contracts?
What is our risk appetite, and do we have an enterprise approach to risk management?
Are we ready to respond to a breach?
Source: NACD

WHAT LEADERS SAY

A recent Ernst and Young survey of 1,200 C-Suite leaders at the world’s largest organizations found worry and weakness when it comes to cybersecurity.

89% say their cybersecurity function doesn’t meet their organization’s needs.
87% say they need up to 50% more budget.
64% say malware attacks increased in 2017, compared to 52% in 2016; phishing is up 64% vs. 51%.
57% don’t have or have an informal threat intelligence program.
48% don’t have a security operations center (in-house or outsourced).
17% of boards have sufficient knowledge of effective oversight of cyber risks.
Only 12% feel it’s very likely they would detect a sophisticated cyber attack.

WHAT TO DO NOW

Do the Basics. Identify and patch all known vulnerabilities. Require multi-factor authentication, not just passwords, for access to your systems. Limit the number of people who have has access to the most important parts of your network. Be sure to guard your back door—supply chains and third parties.

Examine the Impact. Take the time to think about the impact of cybersecurity on your company. What’s the worst that could happen? Are you addressing it?

Get Your Board Right. Look hard at your directors to be sure that they’re suited for today’s world. Do you have cyber expertise on your board?

Be Ready. Rehearse your incident response plan. Some 38 percent of U.S. companies have no plan, and of those with a plan, one-third have not reviewed it since it was initially developed, according to the National Association of Corporate Directors.