Cyber resilience and the digital enterprise

1. Engage the C-Suite

It is now a generally accepted fact that cyber risk and resiliency need to be C-Suite level concerns and no longer safely tucked away in IT or ignored. Cyber risks affect every organization no matters its size or sector, and should, therefore, be included in management and governance processes. Leadership needs to acknowledge the importance of keeping data secure and if the C-Suite doesn’t drive awareness, then training will be ineffective.

“Fundamentally, the C-Suite wants the same thing: happy, trusting customers served by healthy engaged productive people, conducting business sustainably, compliantly, and profitably,” states Elizabeth Queen. According to Queen, “cybercrime threatens this equilibrium, whether looking at it from an engagement, trust, sustainability, or business perspective. The only effective way to manage a rapidly evolving, multi-dimensional threat like cybercrime is with a united multidisciplinary, risk-based approach.”

2. Unite stakeholders to build awareness

Unfortunately, no organization is immune to the risks presented by cyber threats. In January 2019 alone, according to itgovernance.co.uk 1.76 billion records were leaked from various data breaches around the world in January 2019 alone. Building awareness of these threats must be a top-down focus and, in many cases, specialized roles must be introduced, for instance, a Chief Information Security Officer. New roles help build awareness and often unite employees.

In May 2019, Wolters Kluwer detected ransomware in a portion of our environment, so we know firsthand how disruptive and concerning this can be. This experience tested our preparedness and has made us stronger and more resilient than before. While we proactively took a broad range of customer and internal applications and platforms offline to protect our systems, applications, and customer data, only a small percentage of our products and applications were infected by the ransomware. We promptly informed our customers and employees of the incident and maintained regular communications with them. We engaged with a leading cybersecurity technology firm to conduct a forensic investigation of the incident. The firm has confirmed that there is no evidence that customer data or confidential information was compromised.

At Wolters Kluwer, we work hand in hand with best-in-class global firms that help us evolve our preparedness, prevention, protection and response programs in the face of changing cybercrime. Our employees are empowered to develop their security mindset and use good judgment through regular up-to-date trainings and knowledge-sharing on the characteristics of cyberattacks. According to a recent GetApp survey, 43 percent of employees are left to fend for themselves against cyber threats, receiving little to no data security training. As a result of our training, our employees were able to create a united front in May 2019 during our malware incident. Across the board, all employees came together to respond and solve the challenges faced both on their teams and by our clients.

3. Make security pragmatic

“Security is not about technology, it is about the business and requires understanding business goals so that security can empower the business. At the end of the day, it is just another quality aspect of your product and services,” said Avarvarei. Once you start viewing security as a quality you can measure, you can begin defining your metrics. This means KPIs and service-level agreements, and most importantly, understanding your audience. “When it comes to metrics, less is more. Remember, there’s a cost in measuring targets and too many targets signal a lack of priorities.”

Protecting the interests of your customers, employees and company should be your top priority when building cyber resilience and setting up your cyber readiness.

4. Provide the right incentives for reporting metrics

Performance goals are the classic measure of what’s important for your organization, scaled down from your macro objectives. Therefore, incorporating cyber resilience tactics into performance goals and assigning a dedicated security budget into organizational budgets, whether that be Finance, IT, Legal or Marketing, serves organizations’ incident response plans.