Audience
Director of Cybersecurity, Chief Information Security Officer (CISO), Chief Information Officer (CIO), Chief Technology Officer (CTO), Chief Executive Officer (CEO), Chief Risk Officer (CRO), Head of Audit.
Introduction
Business leaders will have a Cyber Secure business if one Cyber Security question is answered in the following six areas;
Secure implementation of business systems
Ensure that all projects/applications have undergone a comprehensive Cyber Security review, this will involve your technical team performing Threat Models, Penetration Testing and Risk Review of the application and making sure that any Critical and High Vulnerabilities are addressed before the application is commissioned or risks exempted based on the business requirements.
Question to Ask: Do all projects, applications and business systems undergo a comprehensive security review?
Security Monitoring of Business Systems
Even after a comprehensive review is always a residual cyber risk with any application that is implemented within the enterprise or organisation no cybersecurity program however good can guarantee 100% security. Therefore all applications should be adequately monitored on 24/7/365 during its lifecycle by a Monitoring Team to make sure any cyber incidents are caught in a timely manner and addressed promptly.
Question to Ask: Are all business systems monitored on a 24/7/365 basis by a Security monitoring team?
Handling of Cyber Security incidents
When the Cyber Security incidents are identified by the Monitoring Team you need to have a plan in place to systematically respond to the incidents enter the Incident Response plan. The aim being to address Incidents in a systematic and organised manner to reduce the impact on business, collect lessons that will be used to improve your cybersecurity program.
Question to Ask: Do we have lessons to learn from previous cybersecurity incidents?
Security update of Business system
Despite the initial Security review completed before implementation, new vulnerabilities are discovered and reported every day. Its therefore paramount that the organisation have a Patch and Vulnerability management program that keeps track of what vulnerabilities are open within the organisation and how best to remediate or mitigate these.
Question to Ask: Do all systems continuously receive security updates?
User Awareness
When you have a strong technical Cyber Security program across the organisation, hackers resort to exploiting non-technical targets, Humans. People/Users are an easily hackable target and the best way to reduce this risk posed by users to your information technology estate is to implement a strong user awareness and training program across the organisation.
Question to Ask: Do all employees undergo periodic training on Cyber Security?
Stakeholder management
Cyber Security stakeholder management is a key part of the skills required to make sure you have an effective cybersecurity program. You need stakeholders to understand the criticality of Cyber Security and own the process that way you don’t have projects slipping under your watch without adequate review. You need to solicit support and budget for the Cyber Security program. You also need to manage stakeholders when incidents occur inorder to correctly report and manage these incidents.
Question to Ask: Do all key stakeholders understand their role in protecting systems from cyber attacks?
Conclusion
Implementing an effective cybersecurity program might seem too complex or elusive, However when you get the fundamentals correct, you are on your way to a world class Cyber Security program that will greatly reduce your Cyber risk exposure and protect your business from cyber disruptions