The summer months are a notoriously vulnerable time for organisations. They tend to be short-staffed as employees take summer holidays, while budgets are often squeezed following the first few months of the financial year.
Things are especially perilous at the moment with the cost of living crisis. Prices have risen by 7.3% in the twelve months to June 2023, with the biggest increases coming in electricity, gas and transport prices.
Most of us are experiencing these challenges in our personal and professional lives, but the information security sector is particularly affected. That’s because of the problems they’re facing filling the skills gap.
According to the (ISC)2 2022 Workforce Study, the industry grew to 4.7 million worldwide last year. However, organisations estimate that there is still the need for another 3.4 million qualified professionals – a 26% increase from 2021’s figures.
It demonstrates the growing importance of information security in today’s increasingly digitised work environment. But with the demand for expertise far outstripping supply, it creates fierce competition for personnel and drives up salaries.
That’s difficult enough at the best of times, but when organisations are already under financial pressure, it makes it even harder to appropriately resource your information security processes.
Some will be tempted to ignore those requirements, or else they’ll trust that what they have will suffice and hope they don’t fall victim to a security incident. But ‘hoping’ isn’t a strategy we’d recommend, particularly as the cyber threat landscape continues to grow and thrive.
A UK government survey published earlier this year found that 32% of business experienced a cyber attacks in 2022, while IBM estimates that the average cost of a data breach in that time was $4.35 million (about £3.4 million).
Fortunately, there are things that you can do to protect your organisations from cyber attacks besides hiring new employees. Let’s see how you can get started.
Preparing for the inevitable
The most important lesson that organisations can learn regarding cyber security is that they will be targeted by criminal hackers sooner or later. Many people mistakenly think that their business is too small or too unimportant to be on crooks’ radars, but this isn’t typically how they operate.
Rather than identifying specific targets, most criminal hackers look for weaknesses or exploits. That might be a software flaw, a known vulnerability or other piece of information that could help them steal sensitive information.
For example, one of the most common attack methods is phishing, in which scammers send bogus emails that appear to come from a reputable source. These messages request that the recipient enters their login credentials or downloads a file, which can compromise their accounts or their devices.
Criminals typically pick their targets for phishing attacks by purchasing a trove of corporate email addresses that were compromised in a previous attack and put up for sale on the dark web.
Organisations can implement the latest security software to thwart cyber attacks and constantly monitor intrusion attempts, but they will be of little help when an employee hands over their username and password to an unauthorised individual.
Although tools such as two-factor authentication and staff awareness training can help mitigate these risks, you mustn’t rely on your ability to be impenetrable.
Indeed, one of the most important things you can do is to create a cyber incident response plan. This is a document that outlines what your organisation should do in the event of a data breach or other form of security incident.
A cyber incident response plan typically contains six stages that guide an organisation from preparing for and identifying a data breach through to containment, eradication and recovery.
Unlike technical security solutions, cyber incident response plans cannot be purchased off-the-shelf and slotted into your processes. It should be built around your requirements and the resources at your disposal.
Various members of the team will have a role to play in managing and executing the plan, and you will need to run exercises to ensure that everything works as intended.
Understandably, that this can seem like a daunting prospect – particularly given the budgetary restraints and staff shortages that we mentioned earlier.
This is where GRCI Law’s team of experts can help. Our Cyber Incident Response Readiness Assessment provides an impartial review of your organisation’s ability to protect against, detect and respond to a cyber security incident.
The assessment looks at your organisation’s cyber incident response capabilities, threat and vulnerability management, event logging and monitoring, and business continuity.
We recognise that no two organisations are the same and our consultancy team will work with you to ensure that we provide advice that is relevant to your organisation’s size, sector and objectives.
Take the first step towards securing your organisation this summer. Contact us today to schedule a consultation and discover how we can help protect your business.
