Victor Lough, Cyber Security & Advanced Digital Services Business Lead, Schneider Electric, points out the common weaknesses in a business’ defence system and discusses the importance of operating with fully mature cybersecurity.
When you combine the fact that two in five UK businesses have faced cyberattacks over the past year, with the growing accessibility of tools to simplify hacking it’s clear why business leaders are concerned about cybersecurity. Operational cybersecurity vulnerabilities are common across the board. Whether your business is in the financial, industrial, education or power sectors, without proper protection, no industry is exempt from this risk.
Knowing where your systems are vulnerable is the first step to protecting them. To gain these insights, a comprehensive assessment and analysis is needed to reveal the gaps between the current security state and the end-goal of worry-free protection. There are some gaps that crop up in almost every business:
Understanding the threat
Firstly and possibly most obviously, cybersecurity starts with understanding the risks. Communicating current security risks to the entire workforce is a primary step in securing a business, and often the simplest gap to fill in a company’s protection.
For example, an increase in remote monitoring and third-party access has also led to a rise in cyber vulnerabilities. The IoT-connected devices that have enabled so many businesses to quickly transition to homeworking bring challenges along with benefits. These tools have essentially increased the ‘attack surface’ for hackers and, in many cases, have acted as an organisation’s Achilles’ heel.
With only 16% of cybersecurity professionals having more than a week to ensure that remote systems were secured before making the shift to remote working, it’s fair to say that the preparation for remote access related security threats is far from mature in most cases. However, building an awareness of the current risks is the first step to mitigating them.
Holistic protection
In many cases, people are the first and last lines of protection, so collaboration between teams, including higher management, is essential. However, a common gap in a business’ security is caused by a disconnect between teams, particularly between management and operations.
Embedding cybersecurity into your operations, from design to manufacturing, from delivery and commissioning to maintenance and operating, takes the enterprise – everyone, everywhere – to understand and accept their own responsibility for cybersecurity. In particular, this means bringing IT and OT together so they can help the entire organisation – not just an area, a function or individual team – be as secure as possible.
Establishing this ‘we’ culture helps to connect the dots across the enterprise, fill gaps and maintain always-on vigilance. This change starts from the top. Employees and vendors, at any level of seniority, need to be aware of and complaint with security policies. This ‘all-in’ approach is what will garner more thorough and consistent commitment to the cybersecurity initiative throughout the organisation.
Understanding your assets
Many cyberattacks are successful because employees have caused unintended errors. It is important that staff are aware of, and vigilant against, cyberthreats. This doesn’t just mean blanket, company-wide training on how to spot a phishing email, but also establishing the specific threats associated with the assets under an employee’s care. These could include specific protocols around the use of passwords, policies around Wi-Fi access or regular auditing of user accounts and permissions.
This gap has been especially prominent over the past year, during periods of heightened activity or business restructuring, as personnel who move into a new work environment, including into a new physical space, are even more vulnerable to threats and attacks.
Before attempting any reorganisation, companies need to consider the types of data and technology they require the reallocated workforce to use. Assigning new or inexperienced workers to different roles requiring the use of unfamiliar technology is always a risk, which is amplified when malicious activity is on the rise. During a crisis, it’s a dangerous combination that could open the door to attacks.
Preparation is key
When it comes to cyberattacks, you can never be too prepared. Implementing proactive, tested incident response and risk mitigation plans which are documented and tested, are an essential step in minimising risk and strengthening customer assurance. A security-aware environment should audit and enforce cybersecurity best practices on a consistent and effective basis, utilising available supervision and detection tools, so that exposure to threats is as limited as possible.
However, in terms of risk mitigation, companies tend to deal with what they perceive to be high-probability, disruptive events that are most likely to occur and can be planned for. However, this is only one part of the bigger picture.
Business Continuity plans need to also consider events that can disrupt entire industries or, in extreme cases, the global market, such as natural disasters or financial crises and pandemics. While these events are low probability, when they do occur, they can change the assumptions made in all other risk planning – causing gaps in protection capabilities if not properly mitigated.
Limited capabilities
When it comes to cybersecurity, many companies are very conservative – sometimes for good reasons – but that needs to change. A collaborative approach that draws on the expertise, capabilities and visibility of all parties is the key to closing these gaps and achieving fully mature cybersecurity for a business.
Unsurprisingly, most business leaders do not have the knowledge and experience to enact a cybersecure business strategy. That is why collaborating with skilled and certified professionals who can provide vendor-agnostic services to help assess an individual business’ risk, implement cyber-specific solutions, and maintain those defences over time, is vital to ensuring no gaps in your armour are left unattended to.
Fully mature cybersecurity is not a destination, it’s a journey, and one that affects the entire organisation. Therefore, there is no quick fix that can be completed over night. It is an ongoing and accumulative process, but if conducted correctly, it can be of significant benefit to a business and not a burden.
