Cyber Security For Executives

Cyber security is the responsibility of everyone in the organisation, but it’s down to the leadership team to start the ball rolling and set the correct tone from the top. Entrepreneurs, managers, and their executive-teams play a crucial part within a business; down, in no small part, to their influence on corporate culture and the way that behaviour is shared and learnt inside work environments.

It’s true that a lack of employee understanding around the subject of cyber security is usually how an issue or breach occurs in the first place. When this happens, cyber-security threats, e.g. Malware, can quickly get out of control and infect the entire office/workplace network – but these risks can be controlled and mitigated through the actions of the workforce.

Remember, gaps in employee knowledge and consequent low confidence levels mean that mistakes do get made, however unknowingly. Seemingly simple things, such as creating inadequate passwords or failing to secure personal storage devices, leave valuable information exposed for hackers to take advantage of.

A Compliance Culture

Management and executive teams can and do impact the culture of the organisations they work for. The way employees observe other employees behaving has a huge effect on the behaviour and attitude of the whole team, and the same is true for compliance behaviour around the topic of cyber security.

Whilst education and awareness training is an extremely important aspect of cyber security and should never be ignored, it is equally as vital to lead by example when it comes to creating cultures of accountability that encourage all employees to take personal responsibility for their own actions. For example, new employees to the company should not observe other executives neglecting to install system updates, opening unsolicited email attachments, leaving desktop PCs unlocked, and so on. These behaviours indicate a lack of accountability, responsibility, and general cyber-security awareness, and could lead to serious security breaches if permitted to continue through learned behaviour.

Good practice is to nurture an environment whereby employees are regularly trained, updated, and included in discussions about the part they play in compliance activity. The key here is communication across the board, no matter how large the business is, to ensure that standards of conduct are not only maintained, but encouraged and commended. When it comes to cyber security, standards of practice should not be discussed behind closed doors in boardrooms and amongst IT Professionals, all employees play a part in risk management, often as the first line of defence.

Common Security Threats to Businesses:

Cyber-attacks exploit basic vulnerabilities in IT systems, software, and employee awareness. Even the most basic security practices like ensuring system updates are complete in a timely manner and training employees on how to create secure passwords can have a big impact on deterring cyber-criminals away from your organisation – after all, there’s always somewhere else that will have neglected these activities and, thus, made gaining access that much simpler.

Common security threats to businesses include:

Internet and email misuse
Neglecting software updates
Phishing scams
Malware / ransomware
Insecure/unlocked digital storage devices
Social engineering / social media attacks

Small Businesses and Start-Ups

Not just an issue for large corporations to worry about, start-ups and SMEs have around a 50% chance of encountering a cyber-security breach in the UK, largely down to time and budget constraints affecting their cyber security training, software, and awareness programmes. Make no mistake, hackers are aware that smaller businesses are less likely to have put measures in place to protect against cyber-criminals, and use this to their advantage when targeting organisations that may process and store valuable personal data, e.g. credit card numbers.

With worrying statistics for security breaches and increased fines for failing to meet data security responsibilities under the General Data Protection Regulations (GDPR) even entrepreneurs can’t afford for their business to fall short when it comes to matters of compliance. Whether there’s one or one-hundred employees working at your organisation, a culture of compliance should set the standard for the future.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”