Significance of Cybersecurity and Resilience
To
Chairperson
Board of Directors
From: Jane White, Corporate Governance Consultant
Date: 22 January 2019
Subject: Cybersecurity policy of the company
In the world full of technology, every organization is diverting it is focused on the use of technology. The reason behind the same is the infinite advantages that technology adds to the overall value of the company. The use of the internet and other technological innovations makes the working of the companies easy and smooth (Kumar, 2017). These techniques are more often cost-effective and allow an organization to make an uninterrupted inflow and outflow of the organizational information. Now, these days, for a business it is very easy and comfortable to access the market. Almost every area of functioning such as sale, purchase, accounting, logistics management demand specific attention of the management and in such a situation it is the technology only which reduces the burden of the management. Nevertheless, another side of the coin is also necessary to review. These technologies prove a danger for the business sometimes when someone not uses the same effectively. Along with the advantages of the use of such technologies and networks, certain liability also comes across. In such a situation, it becomes the responsibility of the managers to use such advancements in a logical way keeping the confidentiality and integrity (Snedaker, 2007). The report presented hereby is focused on the significance of the security feature with respect to the use of the network, internet, and other technologies in the organization. Further, in conjunction to this, the best practices and methods of data and cybersecurity will also be featured in the subjective report and at last the set of recommendations will be provided to the board of directors of the company in order to develop cybersecurity in the organization.
Cybersecurity can be understood as the protection of data, networks and computer system from digital attacks (Cisco.com, 2018). In order to avoid the unauthorized access of terrorist, cybercriminals, or any other outsider, cybersecurity protects the data and digital equipment. The concept of cybersecurity is not just significant and crucial from the perspectives of individuals but the same is crucial for business entities as well. Many harms are identified that can be there at a place in the absence of proper cybersecurity. These harms and dangers include financial frauds, production of child pornography, manipulation of data, taking over the control of the system and so on (De Bruijn and Janssen, 2017).
Methods to Increase Cyber Resilience
In today’s time, organizations are used to manage almost every task with the help of machines and technology such as the internet, networks, and computers. Failure in any one or more than one can lead to great issues. All the business data can be stolen by just one click and businesses can lose their significant trade secrets (Bordony, 2018). Such issues not only make the financial loss to the firms but also lead the issue of loss of goodwill. The public often feels fear to trust an organization that has ever faced the issue of cybersecurity failure. They do not feel their data secured with such entities. Many of the cases have happened there where terrorist hacked the websites, data-based of the businesses with the purpose to use the same in criminal activities, and hence one may think how dangerous the issue is and how significant is to find a solution.
Cyber Resilience can be understood as the capability to prepare for, answer to, and recover from cyber-attacks (Kott and Linkov, 2018). It is helpful for an organization as this protects the same from cyber-attacks and ensures the capability of an entity to fight against such attacks. The concept is new and has emerged during the past decades, as the traditional measure of cybersecurity does not seem to be enough (Linkov and Kott, 2019). There are many methods by using which an organization can increase its cyber resilience which is further stated in this report.
In relation to cybersecurity, management has immense responsibility. An organization has data related to all the stakeholders and in such a situation; it becomes the responsibility of the management to keep the data secure (Morgan, 2018). The trust issues related to cyber security exist at many levels and to removes all the issues, it is necessary to make a focus in this area. This issues does not only exist within the origination but the outsider stakeholder also feels themselves as a part of cyber security gap. The issue can better understand by following diagram:-
Cyber-attacks are the lead issues that the management of the organizations of almost every industry is facing these days. This is the reason that the management is required to develop the policies of these subjects in advance. Only preparation of the cybersecurity and resilience protocols/policies are not enough but the management must ensure their enforcement and effectiveness. It is the management of the company, which is responsible for good corporate governance. Data privacy and security is another aspect of corporate governance as it develops the trust of the public in an organization. Reviewing and considering the impacts of data breach incidents, this would not be wrongful to state that cybersecurity is the prime responsibility of the management (Shrobe, Shrier and Pentland, 2018).
Role and Responsibility of the Board in Cybersecurity
As a part of corporate governance as well as corporate social responsibility, it is required to take certain steps in the field of cybersecurity by the management. As mentioned above that some methods to increase cyber resilience are there, the same are mentioned hereunder:-
- The inclusion of cybersecurity in governance process:- This is a very first and necessary step which demands the board of directors to include the topic of cybersecurity in their governance process. The method says that the board of a company should consider the topic of cybersecurity as one of their important agenda when it comes to the surety of good corporate governance practices.
- Strengthen cybersecurity protection for key assets:- Using the cybersecurity techniques for all the assets can lead to an issue of budget. Therefore, this is to suggest that an entity should divert the resources of cybersecurity on the major assets mainly. Here these methods demand that the person responsible for corporate governance in the organization should study the level of risk of cyber-attacks with respect to all the assets and divert the focus and resources accordingly. For the major assets, the control should not limit typical options and should go beyond the same using methods such as data loss prevention, encryption, instruction detection, access right, and patching.
- Development of security features: – An organization is required to build and develop the security features for their IT systems. In house software and app, developers must have certain tools that are useful to develop the strengthen system which is strongly protected from unauthorized access and is less susceptible to hackers.
- Use of active defenses:- This is the technique by using the same an organization can get the signals of impending attacks. Some big companies use the technique of big data analytics to get the signals of unauthorized access to their networks or cyber-attacks (Dhingra, Gryseels, Kaplan and Lung, 2018).
The above-mentioned points are few of the methods that can improve the cyber resilience in an organization. Now moving the focus towards recommendations regarding the practices that should be used to initiate a cyber-resilience, this is to mention that the management of an organization is required to consider cyber-resilience as a management tool. At the board level management can perform the following functions to initiate a cyber-resilience effectively:-
- Discussion and scope sharing: – This can be treated as the initial step. Before doing anything in the subjective sector, it becomes the responsibility of the management to identify the areas where cyber resilience is required. Afterward, managerial personals are required to share their knowledge on this subject and they are advised to develop a structure of cyber resilience. The management can also develop some committees to divert the responsibilities. These responsibilities must be clear and properly communicated.
- Communication: – Only development of cyber resilience policy is not enough but the management must also properly communicate the same to respective people (Shoemaker, Kohnke and Sigler, 2018). It means the cyber resilience officer and other executives should be aware of the expectations of the board. This is an effective step, which lead a positive impact on the in house governance.
- Defining role and responsibility: – While communicating the cyber resilience policy to the organizational personnel, the board is also required to define the roles and responsibilities of them. It is the step where the board held the people accountable for their jobs. The employees must have sufficient knowledge, experience and enough authority with respect to their works.
- Surety of resources: – Management of the company should check whether the cyber resilience officer and other employees who have the responsibility of data and network security have the proper resources and assistance to complete their jobs (Veltsos, 2017). These resources may be helpful to make, implement, assess, and polish cyber resilience efforts across the entity.
- Regular updates: – At the board level, it is the responsibility of the management of the company to keep itself update about the current threats to the digital system. Further, the management must be aware of various kinds of data breaches that happen in the related business environment. In conjunction to this, the board of the organization is also advised to keep itself aware of the latest technologies that business competitors are using these days in against of cyber-attacks.
- Alignment with the overall governance: – For an effective cyber resilience policy, it is to ensure that the same must not contradictory with the overall governance structure of the organization. It means the board of the company must ensure that the plans, policies, strategies, and rules are in line with the overall governance of the organization.
- Collaboration and Training: – To ensure continued corporate survival and improved business performance, training is a must. In order to develop the staff education and awareness, the board should organize training and such training must be monitored and managed against success criteria. Through Continuous development, staff became a more aware and effective defense in against of malicious cyber activities (Asic.gov.au, 2018)
- Review: – After the implementation of cyber resilience policy across the organization, the board should timely review the same in order to check the success or failure. This is an important activity to do which let the board of directors informed about deficiencies in the current system. Random staff testing, continuous monitoring systems are some of the tools using which the board can review the effectiveness of cyber resistance policy (Graham, Olson and Howard, 2016).
- Response and recovery planning: – If in the review process, the board of the company comes to know about the loopholes or any failures, then it becomes the responsibility of the same to fix it. Until the deficiencies would be there, a cyber-resilience cannot seem to be there and therefore it is a significant step to be done (Estuate.com, 2018)
Conclusion
This is to conclude that in the current century, cybersecurity becomes as much important as the same cannot be ignored. Not just the individuals but also the organizations and their whole systems are way much dependent on the technologies and therefore cybersecurity becoming significant day by day. The report hereby presented prescribed the background and requirements of cybersecurity in the organization. In addition to this, the same has also presented the meaning of cyber resilience and need of the same. The report identified the role and responsibility of the board in respect to the cybersecurity of the organization and the same have found related to the corporate governance., This is to state that many of the methods have been given in the subjective report using which the organization can protect the database and networks secure. In general, all the mentioned tools are useful but the most useful one is active defense. This defense identifies the cyber-attacks in advance and makes the cyber resilience officer enable to prevent the same. Further, as asked by the board of directors, the report majorly focused on the ways and techniques, which are useful, while integrating the cyber resilience protocols. All the steps given are important. The focus mainly made on the practices of the board of directors and management of the organization. It means all the given activities such as discussion, communication, resources allocation, and review need to be done at the board level. The most important point, which again needs to be a highlight, is the alignment of cybersecurity protocols and policies with the overall governance as this should be part of the company’s governance and should not overlap the same.
References
Asic.gov.au. (2018) Cyber resilience good practices. [online] Available from: https://asic.gov.au/regulatory-resources/digital-transformation/cyber-resilience/cyber-resilience-good-practices/ [Accessed on 23/01/2019]
Bordony, S. (2018) The importance of maintaining cyber security in your business. [online] Available from: https://www.itproportal.com/features/the-importance-of-maintaining-cyber-security-in-your-business/ [Accessed on 23/01/2019]
Choi,J., Lung, H,. and Kaplan, J. (2017) A framework for improving cybersecurity discussions within organizations. [online] Available from: https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/a-framework-for-improving-cybersecurity-discussions-within-organizations [Accessed on 23/01/2019]
Cisco.com. (2018) What Is Cybersecurity? [online] Available from: https://www.cisco.com/c/en/us/products/security/what-is-cybersecurity.html [Accessed on 23/01/2019]
De Bruijn, H. and Janssen, M. (2017). Building Cybersecurity Awareness: The need for evidence-based framing strategies. Government Information Quarterly, 34(1), pp.1-7.
Dhingra, A., Gryseels, M., Kaplan, J., and Lung, H. (2018) Digital resilience: Seven practices in cybersecurity. [online] Available from: https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/digital-blog/digital-resilience-seven-practices-in-cybersecurity [Accessed on 23/01/2019]
Estuate.com. (2018) How to build Cyber Resilience in your enterprise?. https://www.estuate.com/company/blog/how-build-cyber-resilience-your-enterprise
Graham, J., Olson, R. and Howard, R. (2016) Cyber security essentials. New York: Auerbach Publications.
Kott, A., and Linkov, I. (2018) Cyber Resilience of Systems and Networks. Switzerland: Springer.
Kumar, V. (2017) Top 25 powerful advantages of internet for business. [online] Available from:https://www.klientsolutech.com/top-25-powerful-advantages-of-internet-for-business/ [Accessed on 23/01/2019]
Linkov, I. and Kott, A., 2019. Fundamental Concepts of Cyber Resilience: Introduction and Overview. In Cyber Resilience of Systems and Networks (pp. 1-25). Springer, Cham.
Morgan, J. (2018) Board and management responsibilities for information security. [online] Available from: https://www.cio.com/article/3252783/governance/board-and-management-responsibilities-for-information-security.html [Accessed on 23/01/2019]
Shoemaker, D., Kohnke, A., and Sigler, K.(2018) How to Build a Cyber-Resilient Organization. NW: CRC Press.
Shrobe, H., Shrier, D. L. and Pentland, A. eds., (2018) New Solutions for Cybersecurity. Cambridge: MIT Press.
Snedaker, S. (2007). Business continuity & disaster recovery for IT professionals. Burlington, MA: Syngress.
Veltsos, C. (2017) Cyber Resilience Tools and Principles for Boards of Directors. [online] Available from: https://securityintelligence.com/cyber-resilience-tools-and-principles-for-boards-of-directors/ [Accessed on 23/01/2019]
Order an Essay Now & Get These Features For Free:
Turnitin Report
Formatting
Title Page
Citation
Outline
