Businesses Must Face the Reality of Cyberattacks

With each passing year, as networked technology becomes more and more integral to how companies do business, a simple yet grim reality comes further into focus: The cyberattacks will continue.

Many experts urge business owners and their leadership teams to view malicious cyber activity as more of a certainty than a possibility. Why? Because it seems to be happening to almost every company in one way or another.

A 2023 study by U.K.-based software and hardware company Sophos found that, of 3,000 business leaders surveyed across 14 countries (including 500 in the United States), a whopping 94% reported experiencing a cyberattack within the preceding year.

Creating a Comprehensive Strategy

What can your small-to-midsize business do to protect itself? First and foremost, you need a comprehensive cybersecurity strategy that accounts for your technology, your people, your processes, and as many known external threats as possible. Some of the primary elements of a comprehensive cybersecurity strategy are:

• Clearly written and widely distributed cybersecurity policies,
• A cybersecurity program framework that lays out how your company: 1) identifies risks, 2) implements safeguards, 3) monitors its systems to detect incidents, 4) responds to incidents, and 5) recovers data and restores operations after incidents,
• Employee training, upskilling, testing, and regular reminders about cybersecurity,
• Cyber insurance suited to your company’s size, operations, and risk level, and
• A business continuity plan that addresses what you’ll do if you’re hit by a major cyberattack.

That last point should include deciding, in consultation with an attorney, how you’ll communicate with customers and vendors about incidents.

Getting Help

That may sound overwhelming if you’re starting from scratch or working off a largely improvised set of cybersecurity practices developed over time. The good news is there’s plenty of help available.

Cybersecurity policy templates are available from organizations such as the SANS Institute for businesses looking for cost-effective starting points. Meanwhile, there are established, widely accessible cybersecurity program frameworks such as the following:

• National Institute of Standards and Technology’s Cybersecurity Framework,
• Center for Internet Security’s Critical Security Controls, and
• Information Systems Audit and Control Association’s Control Objectives for Information and Related Technologies.

Plug any of those terms into your favorite search engine, and you should be able to get started.

Of course, free help will only get you so far. For customized assistance, businesses can always engage a cybersecurity consultant for an assessment and help implement any elements of a comprehensive cybersecurity strategy. Naturally, you’ll need to vet providers carefully, set a feasible budget, and be prepared to dedicate the time and resources to get the most out of the relationship.

Investing in Safety

If your business decides to invest further in cybersecurity, you won’t be alone. Tech researcher Gartner has projected global spending on cybersecurity and risk management to reach $210 billion this year, a 13% increase from last year. It may be a competitive necessity to allocate more dollars to keep your company safe. Contact us for help organizing, analyzing, and budgeting for all your technology costs, including cybersecurity.

© 2024