Innovation Insight: How to Build Resilience Against Cybercrime

At this month’s Innovation Day, KnowledgeBrief clients were joined by Dr Peter Trim, Birkbeck University of London, to highlight the risks and challenges of cyber security, and provide guidance on what can be done to counteract the growing threat posed by cybercrime.

We think we understand the threat from cybercrime and we think that we take the risk seriously. But do we really? The cyber landscape is very wide, and one organisation can be hit at multiple levels at one time. All too often, senior management think technical controls can provide substantial protection against cyber threats. However, organisations need to remember that cyber security is not just an IT problem. Cybercrime is just as much an issue to address for:

• C-suite: Is cyber security a regular topic on the board meeting agenda? How can senior management make sure that IT, HR, marketing, legal and other business units meet regularly to discuss digital and cyber security?
• Human Resources: Does your organisation provide cyber security training for employees? Do you have clear security policies on how employees use and share information?
• Marketing: How does your organisation collect, use and protect data? What happens if your data gets stolen, manipulated or duplicated?

As well as reinforcing a collectivist approach to cyber security, KnowledgeBrief clients at this Innovation Day – including Miki Travel, UK Power Networks, Sunderland City Council and Warrington CCG – identified the following three important conclusions:

• Build a security culture: Resilience is a collective effort – everybody has ownership of it. Establish and build a security culture that reinforces security awareness, influences the values of the organisation, and encourages managers to be pro-active in addressing security resilience.
• Analyse and identify the risks for your organisation: Remember that organisations are unable to react to every single risk – it is too complex. Look carefully at individual risks, how they fit within your organisation, and then prioritise them. Think about which form they will take, and what the consequences will be should a cyberattack manifest.
• Formalise, implement and review your business continuity management: It can seem difficult to formalise things when the risk impact it very complex. Every company should have a written plan that identifies cyberattack scenarios and sets out appropriate responses to rapidly recover. This plan is more than just a box-ticking exercise once a year to be filed away; it is to be reviewed on a regular basis and amended accordingly.

Next, this group will focus on delivering excellent customer experience. For more information, please view the Innovation Day page.