Cyber security procedures: helping you to reduce the cyber risk to your business

In the second article of our series with Cyberscale, Darren Chapman talks us through the importance of cyber security procedures and how they can help reduce the cyber risk to your business.

• Why is having a cyber security procedure important?
• What areas would need to be assessed for a cyber security procedure?
• How do you put together a cyber security procedure?
• How can you make sure the protection you put in place will work when needed?
• What else can businesses do to protect themselves?

Cyber security procedures perform an important part of a businesses’ preparation and protection from cyber-attacks. Further, having certain cyber security procedures in place in your business is also a pre-requisite for cyber insurance. In this article we look at the importance of these practises, the process to go through to put them together and how they can help to reduce the risk of a successful cyber-attack.

Why is having a cyber security procedure important?

Ensuring you have the correct policies in place goes a long way to creating a culture of proactive cyber security. If the procedures are well developed and directly relevant to the work being carried out by your teams, they are more likely to be engaged with, understood, and followed. Sometimes this can seem like a daunting task, knowing what should be in place and how to develop a procedure isn’t a skill available in all organisations.

Security practises help to shape the security position of a business, and this is the case for businesses of all sizes across all industries. Often smaller businesses may not see the relevancy as they don’t feel that they would be a target, however smaller businesses are often more vulnerable as cyber attackers exploit their lack of preventative measures. It is often easier to develop more simple processes in a smaller organisation and embed them into a small team, than it is to do something more complex and roll it out to hundreds of staff.

It’s also important to remember that businesses are obligated to protect personal data that they use and store. If your business suffers a data breach and you haven’t taken adequate precautions to protect that data you could be investigated by the Information Commissioner’s Office and be hit with restrictions, warnings and costly fines.

Whether you have cyber insurance in place or not, cyber-attacks and data breaches can be very costly. It is key to ensure security protection is not just focused on systems and technology, but also people and processes. Given our new ways of working and the shift in the level of oversight IT departments have on devices and working practices, this has never been more important.

What areas would need to be assessed for a cyber security procedure?

There are a wide range of areas where a strategy is required to underpin how a particular security topic is approached, such as Remote Working, Access Control, Password Management, Physical Security, Device Security. All these areas require individual focus but also must be assessed in relation to one another too. This is where bringing together a range of areas of expertise, and cyber security specialists, can greatly enhance the protection development process.

How do you put together a cyber security procedure?

Procedure development should include a range of departments from within the organisation, starting with the Board and covering Legal, HR, Finance, Procurement, and IT. Consulting different departments ensures perspective from all angles and brings together the people who would be responsible for embedding the practises within their departments and teams.

Beginning with a focus on discovery, you will need to look at the existing state of your cyber security (if you have any) and what is important to your organisation, such as compliance with industry regulations or required certifications. It is then important to act on recommendations made and move quickly to the creation and implementation of procedures. Identifying risks will guide the direction of the process, and it is important to ensure that decisions made are always relevant to your specific needs and working practices. You can find more information on this process here.

The focus of cyber security should always be on the primary areas of importance for the organisation, whether this be security of customer data, protecting banking information or critical systems access.

Without a consistent approach to procedure development that embeds them into an organisation, there can be inconsistencies in the way different departments or teams approach security and working practices which can increase the risk to security and information breaches. It is of paramount importance that regular review and development of practises is conducted as the business and its operations evolve, alongside the ever-changing landscape of cyber threats.

Cyber security procedures do not stop having an influence once they are embedded into the organisation. They should be used to guide the development and implementation of more detailed procedures and working practices, which will ensure that the process is successful in day-to-day operation. Cyber security processes should not be about holding employees to account in the face of a breach, they should be viewed as a set of supporting principles to protect the business and its employees which encourage ongoing learning and development.

How can you make sure the protection you put in place will work when needed?

Having procedures in place may feel like you have better protected your organisation, but they won’t come into action until a cyber-attack happens, so it is important to use them as early on as possible.  One way of doing this is to put in place a series of desktop exercises that test both the process and employee. Ensuring the scenario is made personal and relevant will increase understanding and help protect the business should a cyber-attack occur. This is something that is often completed when testing incident response approaches.

It is also worth noting that although cyber security procedures are important for all types of organisations, the significance of well-defined security processes in regulated industries such as healthcare, finance, insurance, and law often requires a much more thorough approach. The potentially large fines for businesses in these industries that have compromised client data can be detrimental to the reputation and prospects of the company. Given the potential fines for companies that operate in these industries, cyber insurance is also an incredibly important aspect of their cyber security.

What else can businesses do to protect themselves?

There are other aspects of the cyber security mix which can further bolster your security position, including Incident Management and Staff Training. With a robustly developed plan which is tested regularly and kept relevant to the changes in your business and industry, your approach to incident management operates as a central part of your cyber security strategy which is directly linked to your procedures. You can read more in this article about the importance of Incident Response Planning.

Completing regular staff training gives organisations the opportunity to keep their staff up to date with new threats and changes within cyber security, and also enables the concise communication of new practises and changes to existing ones without this getting lost in translation. Investing in training is a great way to get everyone in the business participating and gives them accountability for the business’ cyber security.

A final additional line of protection that should sit alongside your cyber security procedures is taking out a tailored cyber insurance policy. According to the 2021 UK Government’s Cyber Security Breaches Survey “Over four in ten businesses (43%) and three in ten charities (29%) report being insured against cyber risks in some way…this is more likely to be through a broader insurance policy, rather than one that is cyber-specific” – this certainly leaves space for improvement. Assessing what cyber insurance you need and what level of cover will best protect your organisation takes experience. Cyber insurance gives your business an added level of protection so that the long-term viability of a business is secured if they were to suffer a cyber-attack.

Cyber risks are always going to be present and having the right policies, procedures and supporting elements in place will go a long way in protecting your organisation. Better preparing your staff to spot threats and engage with them safely, or in the face of an attack feel best prepared to help, limits the impact and potentially costly consequences.

To discuss cyber insurance and how this policy could benefit your business, contact Alan Boswell Group on 01603 218000.

CyberScale are a Cyber Security Consultancy and Training provider.  They provide pragmatic IT Security and Data Protection for businesses throughout the UK.  Cybersecurity and data protection can be confusing and hard to keep up with, especially without dedicated staff. CyberScale will translate threats and regulations into what’s relevant to your business, and explain everything in a clear, non-technical way.  Cyber Security is complex so making it simple is key, so you can concentrate on running your business. To find out more, contact CyberScale on 01603 339550 or email [email protected].