5 Tips for a Holistic Approach to Cyber Resilience

The rapidly evolving digital landscape has brought about significant challenges for organisations, with cyber threats becoming a prevalent risk. Let's turn up the dial from Cyber Security to Cyber Resilience.

In wrapping up from our recent "Cyber Resilience Strategies to Secure your Organisation" webinar, we recap the five topic areas discussed by our very own Gavin Hall, Business Technology Consultant. It highlights the essential components within each area crucial for safeguarding your cyber security and maintaining resilience in the ever-changing digital environment. 

A recent survey by the Australian Institute of Company Directors reveals that 53% of directors believe cyber-attacks have impacted their board's risk appetite more than inflation and even the challenges posed by the Covid-19 pandemic.

Given the directors' crucial role in navigating this complex landscape, acknowledging that cyber risk, while impossible to eliminate entirely, can be efficiently controlled, is imperative for sustained long-term success.

5 Tips for Cyber Resilience for Long-Term Success

1. Cyber Accountability

Directors must elevate their cyber literacy levels to effectively manage this ever-present risk.

The AICD and CSRC have provided principles for a top-down approach. The five principles are;

1. Roles and Responsibilities - Defining roles and responsibilities for information security.
2. Cyber Strategy – Developing a robust cyber strategy aligning with business objectives.
3. Risk Management Practices – Clarifying the roles of third-party entities while maintaining ownership of risks.
4. Cyber Resilient Culture – Ensuring accountable individuals have the necessary resources.
5. Cyber Incident Planning – Having a proactive approach to training and review processes.

2. Legal and Regulatory Changes

Understanding and staying up to date with the legal landscape is crucial as regulations evolve.
Some current key developments include:

• SOCI (Security of Critical Infrastructure) regulations across 11 industries.
• Proposed changes to the Privacy Act, potentially impacting small businesses.
• The NSW PPIP Act for mandatory breach reporting in the public sector.
• The impact of APRA CPS230 on third-party risk management in financial institutions.

3. Essential 8:

The Essential 8, designed by the Australian government, offers a foundational strategy for cyber security.
The mitigation strategies that constitute the Essential 8 are:

1. Application control.
2. Patch applications.
3. Configure Microsoft Office Macro settings.
4. User application hardening.
5. Restrict administrative privileges.
6. Patch operating systems.
7. Multi-Factor Authentication.
8. Regular Backups.

When considering the incorporation of the Essential Eight Cyber Security Strategies, a business must take into account the varying degrees of maturity in their implementation. Mandated levels are present in governmental initiatives, with emerging contractual obligations becoming increasingly prevalent in specific industries. To accommodate diverse organisational circumstances such as budgetary constraints and resource limitations, there is a flexibility to stagger the implementation of these measures for small to medium business sizes.

This approach ensures a strategic alignment with available resources while addressing the evolving landscape of cyber security requirements.

4. Corporate Governance

Governance plays a pivotal role in managing cyber risks.

For small businesses with limited governance processes it is recommended to:

• Introduce risk considerations into decision-making processes.
• Engage in cyber security reviews during contract renewals with key third-parties.
• Implement simple risk registers to facilitate ongoing risk awareness and discussion.

5. Cyber Insurance

Insurers are increasingly focusing on due diligence, and common controls are emerging:

• Common controls include MFA, Endpoint protection, Data Backups, and Incident response plans.
• Emerging controls such as top management engagement and vulnerability scanning are gaining importance.
• A proactive approach to understanding and managing risks is crucial for obtaining and maintaining cyber insurance.

Check out our latest blog on Cyber Insurance and how it is driving security requirements for business.

A holistic approach to cyber resilience involves understanding and embracing the evolving cyber landscape. Directors must enhance their cyber literacy, adapt to legal changes, implement foundational cyber security measures, integrate risk management into governance processes, and actively engage with evolving cyber insurance requirements.

By addressing these five key areas, organisations can build a robust foundation for cyber resilience, navigating the complexities of the digital age with confidence.