The complexity of today’s cyber environment has grown exponentially in recent years, making it extremely difficult for a nonprofessional to handle. Businesses must not adopt a casual approach towards cybersecurity; rather, they should deal with it through a planned, methodical strategy.    

What should be the correct approach?      

Cybersecurity is not just about knowing the prevalent threats and the best available safeguards. Neither is it an area to be left solely to the IT department. The complexity of cybersecurity must be understood by C-suite executives and other upper management, many of whom have no substantial experience with IT. So, what is the correct approach to handle this nuisance?

The answer is, that for executives and top management, cybersecurity should always be dealt like any other conventional threat to their business goals; the technical details are unnecessary. This stance towards cyber-security allows executives to feel at ease regarding the complexity and technicality of cybersecurity while keeping the organisation well-prepared to deal with cyber threats.

Recommended Approach

What are your business goals?

Before tackling any business problem, executives focus on the business goals. By contrast, IT and other departments, are focused on their specific areas, rather than on the overall goals of the business. Because of this limited scope, when individual departments are given complete initiative for tackling organization-level problems, they can sometimes solve the problem for their department, but wind up causing more damage to the business as a whole. Therefore, executives and top management must work together to ensure that individual departments, including the IT security department, have a proper understanding of the big picture and their place in it. This should help reduce and clarify the threat environment for everyone.

What is the value of the assets to be protected?

Customer credit card data, business transactions, trade secrets, or even information gathered from a customer through a website are all examples of IT assets that must be identified by the top management, with the help of the IT security department. They should either be assigned a dollar value or be graded from 1 to 10, based on their criticality. The value assigned to each asset is not its exact cost; rather, the value includes factors like development and maintenance costs, value to rivals, potential legal problems from the asset’s loss or compromise, etc. Valuation provides executives with a clear view of each asset’s priority and allows a cost-benefit analysis to be performed later, after the costs and values of safeguards have been calculated.

What are the relevant threats and vulnerabilities?

Threats are circumstances that can impact assets in such a way that the business experiences some loss. On the other hand, vulnerabilities are defence weaknesses that an attacker can exploit. For example, if virus infection is the threat, then a related vulnerability would be lack of antivirus software on the system.

View full article