What Is Important? Cyber and Continuity Risk

Introduction

New risks are emerging every day in the realm of Cybersecurity, and many organizations are moving quickly to address these risks: developing documentation, procedures, and processes. However, this is often without regard for Cybersecurity best practices. To ensure sustainability, organizations must develop cyber policies, plans, and procedures and put effective controls in place. If these controls are already in place, they should be evaluated frequently to ensure that they address these emerging risks.

It is essential for every organization to review and update their security procedures and policies in order to prepare for emerging business and IT risks. Having a standard and consistent monitoring and incident response program is becoming more and more critical, as attacks occur more often and more viciously, targeting organizations across sizes and industries. In addition, the organizations need to constantly upgrade their security awareness and training programs to educate the employees and other stakeholders about new technology advances and techniques and tools available to prevent cyber attacks. Digital enterprises today need to tailor standard cyber risk methodologies, based on best practices, such as ISO 27005 to fit their organization.

In the event of an attack, to ensure that critical business processes aren’t brought to a standstill, disaster recovery (DR) and business continuity planning (BCP) must be incorporated into the overall cyber-security program. A cyber incident affects both business and technology, thereby requiring disaster recovery and business continuity plans to be invoked and operationalized.

Cyber Security Policies, Plans, Procedures and Controls

Cybersecurity policies, plans, and procedures, though connected, play different and distinct roles. A policy is the highest-level document that expresses what an organization, group, or division will and will not perform in terms of managing information and managing the associated risks. A plan is a document that outlines a clear path to accomplishing the policy’s goals. A procedure is specific step-by-step directions to the operator on how to effectively execute a particular task.

Controls are put in place to guard a system against loss or damage. For example, implementing a system of identification and authentication controls ensures that only authorized users and system components can access vital data. Though controls may vary, the end objective is to always mitigate or reduce a risk in some form.

Security Personnel, Physical and Environmental Security

According to the FBI’s Cyber Crimes Division, the majority of all data theft and computer-related crime happens via internal sources. Therefore, implementing personnel security measures, appropriate to the type of business and data to protect, is crucial. Executing potential safeguards, like performing extensive background checks on new employees, separating duties, and administering the right controls such as instant revocation of credentials after dismissal of an employee, all combine to help mitigate risk posed by internal personnel. Physical and environmental security are equally important to protecting an organization from attacks.

Awareness and Training

The most vulnerable aspect of a system is undoubtedly the human element. Users need to be trained on how to protect the system from unauthorized access to valuable and confidential data. Also, users that have other important information and knowledge serve as one of the biggest vulnerabilities for a cyber intruder. The training should include both technology and behavioral aspects to ensure that users are not divulging critical information over phone calls or emails without sufficient verification. Security training and constant reinforcement via ongoing awareness information sessions reduce the risks affiliated with the human element of a security strategy.

Monitoring and Incident Response

During an emergency event or situation that leads to system failure, a detected or active intrusion, or a virus attack, following a standard protocol and response team is important for timely and effective incident response. It limits the extent of damage an attack can have on the organization.

Business continuity planning and plan exercising are important parts of ensuring a coordinated and standard incident response. It significantly limits the damage as well as improves recovery time.

Disaster Recovery and Business Continuity Planning

IT systems are considered vulnerable to a range of adverse events with the potential of seriously impacting standard business operations, possibly compromising confidential data or integrity and availability of information. Even though proper preparation and effective planning are vital mitigation strategies, it is impossible to completely eliminate the risks and the potential damage posed. Due to this situation, organizations need not have any illusions about the potential threats.

Companies should take utmost care when planning precise steps to take during the event of a system disruption, no matter the magnitude. By ensuring a climate of constant testing and adjustment, implementing effective plans prior to any disruption can mitigate the potential damage and can significantly lower the potential loss of productivity, revenue, and information.

Configuration Management

Without a clearly defined process that carefully accounts for policy mandates, security concerns, business impact, authorization, and oversight, changes to configuration seriously may affect the stability and security of a system. As a result, organizations need to follow standard configuration management processes.

A configuration management process makes sure that network and system updates decrease the chances of penetration via malicious code. It also works to reduce the likelihood of human error.

Furthermore, adding to the security benefits, following a specific and formal change, management process derives more business benefits. These added benefits include having a duplicable process for recreating a product, the capability of efficiently reusing components of a project or product, and important safeguards against loss of intellectual capital should any loss of key personnel occur.

Cyber Risk Methodologies

Cyber risk methodologies normally entail a variety of processes to promptly detect and assess risk to a system or group of systems, providing a duplicable technique to conduct and administer risk management. Most obvious to all methodologies are implementing the necessary resources to execute risk assessments, performing system testing including observation, data analysis, and electronic testing (e.g., vulnerability scanning, penetration testing), and lastly, establishing a way to track and monitor system vulnerabilities and mitigation activities (e.g., plan of action).

Senior management needs to standardize and endorse the risk identification methodology to ensure effective results and consistency across the entire organization‘s critical IT functions.

Summary

Comparison of current cyber security activities with the desired level of preparedness enables the designated staff to identify weak links properly and to deploy the necessary enhancements that can be accounted for to justify the investment budget. Establishing and enhancing cyber security capabilities that are fully integrated into ongoing state of preparedness and efforts help build a solid bedrock to drive collaboration and coordination from across functions and through all levels of the organization. As there is more technology integrated into our nation’s prevention protection, response, and recovery activities, cybersecurity will continue play a crucial role.

The blog content is contributed by Michael Redmond & Vibhav Agarwal. The original blog was published by Disaster Recovery Journal. Click here to view it.