Extreme Weather WILL happen. Cyber Attacks WILL happen. WILL You be Prepared WHEN they strike??

In this blog, I compare cyber threats and natural disasters to explain why a cybersecurity strategy is an important component of business risk management. You can take a proactive, well-planned, level-headed and measured approach to security. The need for security is immediate, and it will never go away.

Natural Disasters and Cyber Threats are Huge Risks

As part of your risk management efforts, you plan for potential extreme weather events …floods, tornados, drought or hurricanes. You want to make sure your business, and especially your people make it through the storms safely. So you appoint someone to be in charge of emergency management planning. Have you assigned someone to plan for cyber-related emergencies?

We hear: “My company is small. We really don’t think we are a target for cyber attack.”
Consider: Just like extreme weather, you must recognize that cyber attacks are inevitable.

• • 62% of all cyber attacks target Small-Medium Businesses (SMBs), approximately 4,000 per day.
  • 60% of SMBs go out of business within 6 months of a cyber attack.^[i]

In fact, the risk of cyber threats is eerily similar to natural disasters. The World Economic Forum recently published its Global Risks Report 2018, which assesses and ranks a wide range of Economic, Geopolitical, Technological, Environmental and Societal Risks.^[ii]

That’s right. Cyber attacks are just as likely to occur as natural disasters. To ensure your organization’s ability to recover, you need to have a game plan BEFORE disaster strikes.

Preparing for Natural Disasters

Government

Municipal, Federal and State agencies prepare widespread alert protocols using emergency response systems… storm sirens, evacuation plans and press conferences to warn the public of pending danger. The Government documents these protocols in Disaster Recovery Plans. The hope is that government agencies can minimize the impact of natural disasters and restore the hardest hit areas to a “normal” state as fast as possible. I hear my local government testing its storm sirens on the first Tuesday of every month.

Business

When your office building was designed, the architect added safety features to protect the building’s tenants.

• Secure storm shelters,
• Fire detection and suppression systems, and
• Security alarms and sirens to alert people of emergency.

When your business moves in:

• You construct emergency response plans.
• You run annual fire drills, and you test your alarms and fire extinguishers.
• You purchase insurance to protect the business and your employees.
• You routinely test your backup power generator to make sure it works as you expect.

Hopefully, you never have to find out if all the planning pays off.

Preparing for Cyber Threats

Planning is critical to managing cyber risk. You should create topic-specific Security Plans:

• Incident Response – guides the organization to detect and handle security Incidents and data breaches.
• Business Continuity and Disaster Recovery – A cyber attack can significantly disrupt your business operations just like a natural disaster, and its effects may be permanently damaging. A good DR Plan includes response for both natural and cyber events.

Test Your Defenses

You also need to test your Cyber Incident Response and Disaster Recovery capabilities, at least annually.

• What if your routine Incident Response results in a disaster?
• What if you can’t restore your systems or data after a disaster?
• How will it impact your business?

Train Your People

When you run fire drills, its to make sure people know what to do if a fire strikes. You should do the same thing with cybersecurity. Ask your CIO if you have ever had a problem because a user clicked on a nefarious link in an email. Training may prevent those occurrences.

EVERYONE in your organization has some responsibility to protect the organization and themselves.

• Would your people be able to recognize a cyber attack?
• Would they know how to report suspicious behavior?
• Do your IT and security administrators know how to handle an Incident?
• Does your executive team know when and how to admit to a data breach?
• Does your team know what to do if a disaster strikes?

Conclusion

Hopefully, you now understand that just like with severe weather, you may not be able to stop a cyber attack from happening, but you can prepare for its impact. If your Risk Manager has security experts in-house, hopefully, you will get to work right away. If you don’t have security resources available, you may want to consider outsourcing the function, particularly if cost is a concern.

• At SCS, we know that the topic of cybersecurity can be confusing and frightening. We offer business-focused guidance to help you navigate the hazards and manage your risks.
  We will speak with you in plain language to help you understand where your business may be vulnerable to cyber threats.
• We help you prepare defenses, in line with your budget limitations.
• We prepare your organization to recover from cyber attack.
• We can even provide a constant watch over your systems to take immediate action as soon as we detect an attack.

Footnotes

[i] https://smallbiztrends.com/2017/01/cyber-securitystatisticssmall-business.html
[ii] https://www.weforum.org/agenda/2018/01/these-are-the-biggest-risks-the-world-faces-in-2018/

About SCS
Secure Compliance Solutions LLC (SCS) provides a suite of cybersecurity consulting and managed security services to fortify your Information Security and Data Privacy programs. We implement technical solutions to safeguard your assets. We drive security strategies to manage business risks, meet regulatory requirements and promote a culture of readiness and resilience.