Why cybersecurity is a board-level issue

Author: Richard McBarnet
Chief Executive Officer, Lumina Technologies

Businesses are all too often sitting on a powder keg of risk. Managing risks of all sorts is part of your good governance process. So why is it that IT risks, which often represent the most likely possibility for harm or damage to a company, are not well understood or engaged with? If you do not already carry out regular external IT audits, then it is time to put them in place.

As an employer, you put measures in place to mitigate fire risk, including regular testing and servicing of your fire alarm and extinguishers. The risks of theft are also taken seriously, and companies always take out an insurance policy and sometimes take out business continuity insurance too. We also understand the health and safety risks, which is why we do manual handling training, ask colleagues to go on first aid courses, etc. As a business owner, I manage all these risks because the consequences would have an adverse effect on my staff and business, hence the training and insurance.

Why your company needs to take the human factor seriously

Many hackers rely on human error – hackers don’t break in, they log in. In fact, when it comes to successful phishing attacks, human error is more likely to play a part than technology. A very common tactic is one that was used recently on one of our clients. A member of staff received an email that seemingly came from her boss asking her to handle a short but urgent task. The hackers were hoping that the seeming urgency of the task would make her do what she was asked without question. However, as in many of these attacks, the email address it was sent from was not her boss’s address, and the email contained spelling and grammatical errors. These are always red flags, and thankfully the staff member had the presence of mind to forward the email to us for investigation. But other companies have not been so fortunate.

Some real-world examples we have seen first hand include a foreign property buyer who was duped into transferring half a million pounds to a phishing hacker. As the buyer was not insured or covered by UK banking guarantees, the buyer sought to recover his losses from the law firm handling the sale.

In another example a UK buyer was tricked into transferring £65k to hackers. The transfer was covered by the UK Guarantee Scheme, so the buyer’s solicitors covered the cost however it took nine months for the money to be repaid resulting in a large impact on cash flow for nearly a year.

Law firms risk suffering major reputational damage, as well as future revenue damage when clients are defrauded, even when they are not directly involved. They also see huge jumps in their insurance premiums.

Examples like this are all too common and I fail to understand why directors and business leaders do not take cybersecurity seriously, especially as the threats are evolving in sophistication and are becoming increasingly likely.

Your company needs to be robust and have a road map as part of your IT strategy that will help you identify the IT and organisational changes you need to make. Technology can only do so much to prevent breaches, and people need to take responsibility for their own actions. In fact, I would go as far as saying that people pose a much bigger risk to your cybersecurity than the risk in the technology itself. A building might have a state-of-the-art security system, but that system will be pretty much useless against thieves if someone leaves the back door open – and, IT wise, this is what will happen if a company has great cybersecurity technology but poor staff training and awareness. Thieves will always check the back door because they know that’s where the weakness is more likely to be.

Mitigating risks

In order to provide your company with an effective cybershield, you need to implement technical as well as organisational measures. You need the right technology and the right policies as well as staff who are trained and alert.

If you take technical measures to defend your company from cyberattack but don’t touch on the human element, then you are sleepwalking into disaster. The most popular notion of a hacker is a geek in a basement trying to break into your system through firewalls in order to launch attacks. However, the reality is that hackers are more likely to get into your system through a password someone has inadvertently given them. Human error makes things so much easier for the hackers, which is why staff awareness and training is so important.

You have to deal with the potential for human error and make sure users know what they need to do. Show them ways of spotting potential problems and fraudulent emails. But do it on a regular basis. There are theories that for something to become a habit it must be repeated and reinforced so it eventually becomes a muscle memory. This is the same with staff awareness of cybersecurity.

In the event of an emergency…

It is also necessary to have measures in place to deal with a successful attack. Everyone needs to be as familiar with the process of reporting a breach as they are with breaking the glass on an alarm in the event of a fire.

Cybersecurity is so important to your company that strategic leadership at board level is an absolute necessity. In my experience, C-level executives are nervous of IT because they do not understand it. As IT is generally managed by technology specialists, the Board generally lets them get on with it and does not question decisions made by these specialists. But IT is there to facilitate your business and help your staff deliver services and products, so it has got to be relevant, help your business be more efficient, and be the right size for your business’s needs. It can only do this if it is integral to your overall business plan, and this can only be achieved at Board level. If you do not already have an IT Director on your Board, then it is time to consider a Virtual CIO who has both the technical expertise and business acumen to understand how technology can protect and enhance your business.