If you are a director, CEO or member of the board, there are five principles you need to know to keep your company safe. Shockingly though, many do not, and companies ranging from large private corporations to small not-for-profits could be at serious risk.
The Australian Cyber Security Centre (ACSC) reported a cyber attack every seven minutes in the 2021–22 financial year. That is compared to every eight minutes in the previous financial year.
It is clear that today, more than ever, you need to secure your network to keep your operations going, safeguard your data and, most importantly, keep your customers' private information safe.
Furthermore, it is possible that the business owner/s and/or board could be liable should a cyber attack occur. The Australian Government has set legal requirements in this regard (see: Corporations Act 2001). It is not just your ethical responsibility to safeguard your business, but your legal one too.
Cyber security and cyber governance are two related but distinct concepts.
What is cyber security (the technology)? Cyber security refers to the practice of protecting computer systems, networks and data from unauthorised access, theft, damage or disruption. It's all about the tangible measures put in place such as setting up firewalls and antivirus software solutions like Managed Endpoint Detection and Response (EDR).
What is cyber governance (the policies, processes and procedures)? Cyber governance, on the other hand, encompasses the organisational and strategic aspects of managing cyber security within an enterprise. It involves establishing a framework and structure for managing cyber risks, ensuring compliance with regulations and industry standards and aligning cyber security with business objectives.
It's important to note that you can't really have one without the other. Both cyber security and cyber governance are crucial for maintaining a secure and resilient digital environment.
The Australian Institute of Company Directors (AICD) and the Cyber Security Cooperative Research Centre (CSCRC) released a set of cyber security governance principles to help guide your efforts.
Just as you have a fire warden, you need specific individuals who are responsible for your cyber security measures. If something does happen, the board needs to know exactly who will be on the ground dealing with it, including internal staff members and any external contractors or counsel.
You need a very clear plan for how the board will interact with management and external consultants, if a breach occurs. This will reduce the potential for time-wasting and miscommunication. Every second counts in these situations.
Your cyber strategy should:
It can be useful to imagine your organisation's worst possible cyber security scenario and plan for that in real time. How would management and the board respond? Document that in precise detail.
The board, directors and team must build up their cyber resilience through regular training and education. Try simulation and penetration exercises.
An example of a cyber security simulation exercise is a "Red Team vs. Blue Team" exercise. In this exercise, the organisation sets up two teams: the Red Team, which represents the attackers or adversaries, and the Blue Team, which represents the defenders or the organisation's cyber security team. The exercise aims to simulate a realistic cyber attack scenario and test the organisation's ability to detect, respond to and mitigate the attack.
Cyber risk is an operational risk that fits within an organisation’s existing approach to risk management. It should be embedded in your regular operations and must trickle from the top down. Leaders must allocate the resources required to create a security-conscious culture. There should be regular training, clear policies and procedures made accessible, continuous education, adequate incident response planning, and continuous monitoring and improvement.
The most thorough way to prepare for a cyber incident is by having a third-party expert test your system. Simulation exercises can be useful as they allow directors to familiarise themselves with the response strategy and make improvements, if necessary.
Download the full principles here.
Do you need help integrating these five principles into your daily operations? The Diamond IT team specialises in reviewing cyber security strategies to ensure they are fit-for-purpose, align with government recommendations and include the necessary defences required to best protect your business from malicious threats.
We can support you by establishing your Essential Eight maturity level and improving your overall cyber security posture.
Our Business Technology Managers (BTMs) and Business Technology Consulting team are specialists in improving your internal cybersecurity and are ready to speak with you. Contact our team on 1300 307 907 today.