As we come to the end of the year and toward the start of a new one, it is a good time to reflect on what businesses should be doing in terms of their IT needs. One of the biggest if not the biggest challenge that businesses face is cybersecurity.
It has not gotten any better. Cybercriminals have grown smarter and become more efficient and sophisticated in how they run their operations. Their goals run counterintuitive to the interests of business everywhere.
Small businesses especially are in a tough spot, as they do not have the resources of larger businesses to invest in a comprehensive cybersecurity strategy. A small business owner who is focused on the mechanics of running their business and providing product and/or service delivery and not considering the business risk that cybersecurity poses are setting themselves up for a potential disaster.
This is not meant to be frightening. It is reality and must be looked at as another business risk to be mitigated. Businesses buy insurance to manage risks to their business. This is no different. You buy insurance in the event that you may need it but hope that you will never need to use it.
It is similar with cybersecurity, except that, unfortunately, you will likely need a cybersecurity strategy in place because you will likely need it at some point. However, not to confuse the issue, it is not simply about buying cyber insurance. Buying cyber insurance is not the sole solution. It is but one piece of the cybersecurity strategy puzzle. In fact, typically cyber carriers will not even issue you a policy now if you have not implemented some form of a cybersecurity strategy. It is not simply about the security software tools either, like antivirus. They are also, but one piece of the puzzle.
A proper cybersecurity strategy includes a wide range of different technologies as well as people and processes to make it effective. The best security tools in the world are not going to stop an employee from clicking on a malware link in a phishing email. User awareness is key.
You also need to know what you are going to do when the cyber incident happens. That is where an incident response plan is important to have in place. Who will lead the effort? Who else among the staff will be involved and their assigned roles? Who are you going to call? And practice various scenarios with all the people that would be involved in a cyber incident response, including both the designated employees and outside vendors. Do not put this part off. The time to practice is not the when the cyber incident happens. At that point, it is a crisis and there will be chaos, and you will likely not have a favorable result.
Again, we must face the reality that a business will get hit with a cyber attack at some point. It is just a question of whether you have properly prepared. It is much like personal health. If you do not take care of yourself and you get sick, you may very likely wind up in a hospital and possibly die. It is no different with cybersecurity. Businesses that do not take the time to implement a proper cybersecurity strategy will likely get severely impacted by the inevitable cyber-attack, and it will be highly disruptive, and the business may very well fail as a result.
A business that does implement a proper cybersecurity strategy and faced with a similar set of circumstances may suffer a “head cold”, so to speak, but will likely fight it off with minimal impact on the business. This is what is called “cyber resilience”. Your business will be resilient against the onslaught of the cybercriminals because you have properly planned and prepared for what WILL happen. If your business has not started this process, the time to begin is now. Again, it is another business risk to be managed, and it will help your business to remain strong and grow.
