According to latest research, corporations across the world are losing billions of dollars every year from the loss of altered or destroyed financial consumer data, traded algorithms, etc. Adding regulatory and legal exposure, the risk only multiplies.
Cyber systems are becoming even more insecure with the explosion of networked connection of almost every physical asset from phone cameras to refrigerators, known widely as Internet of Things. On the other hand, hackers are improvising their tricks. Attacks are being launched against commercial entities for political or economic purposes.
Surprisingly, cyber attacks are cheaper and easily accessible, with even weaker law enforcements. Less than 2% of cybercriminals are prosecuted. The imbalance is worsened because corporate entities undermine cybersecurity.
Cloud computing is cost-efficient but the matter of security gets complicated. Hence, corporate organizations are urgently faced with the need of maintaining their enterprises without risking their security.
To cope with the above, many associations set guidelines for their clients to follow.
The National Association of Corporate Directors Cyber Security Handbook has identified five core principles for corporate boards to enhance their cyber-risk management:
1.Understand that cybersecurity is an enterprise-wide risk management issue. Thinking of cybersecurity as an IT issue to be addressed simply with technical solutions is an inherently flawed strategy. The single biggest vulnerability in cybersystems is people insiders. Cybersecurity costs are managed most efficiently when integrated into core business decisions such as product launches, M&A and marketing strategies. Moreover, in an integrated world, organizations must take into account the risk created by their vendors, suppliers and customers as their weaknesses can be exploited to the detriment of the home system.
2.Directors need to understand the legal implications of cyber-risk. The legal situation with respect to cybersecurity is unsettled and quickly evolving. There is no one standard that applies, especially for organizations that do business in multiple jurisdictions. It is critical that organizations systematically track the evolving laws and regulations in their markets.
3.Boards need adequate access to cybersecurity expertise. Although cybersecurity issues are becoming as central to business decisions as legal and financial considerations, most boards lack the needed expertise to evaluate cyber-risk. Many boards are now recruiting cyber professionals for board seats to assist in analysing and judging staff reports. At a minimum, boards should regularly make adequate time for cybersecurity at board meetings as part of the audit or similar committee reports.
4.Directors need to set an expectation that management have an enterprise-wide cyber-risk management framework in place. At a base level, each organization ought to have an enterprise-wide cyber-risk team led by a senior official with cross-departmental authority that meets regularly, has a separate budget, creates an organization-wide plan and exercises it.
5.Based on the plan, management needs to have a method to assess the damage of a cyber-event. They need to identify which risks can be avoided, mitigated, accepted or transferred through insurance. This means they need to identify which data, and how much, the organization is willing to lose or have compromised. Risk mitigation budgets need to then be allocated appropriately between defending against basic and advanced risks.
Any organization must follow these principles to establish a sustainably secure cyber-risk management system.