TECH TALK: SCOTT MONCUR offers a 10-point checklist to keep your business cyber-safe
We were recently sponsors of and participants in a conference focused on building security and trust in financial services and FinTech. The event brought together leaders across the spectrum of financial services, FinTech, security, and regulation and compliance, to consider collaborative, joined up approaches to tackling some of the shared security challenges facing the industry. As a lawyer working in the financial services sector, cybersecurity, and the associated regulation and guidance in this area occupies a lot of my time.
Cybersecurity is now a key element in all businesses that incorporate “digital” or “cloud” as part of their operational or supply chain model, and advances around technology and data continually impact the way that businesses interact with other businesses or with their consumers at all levels.
Digitisation, the rapid expansion of the business ecosystem, obsolescence of legacy systems and increased interconnection with third parties along the supply chain have all brought increased vulnerabilities, risk and threat, for both consumers and the organisations in which they place their trust.
Over £1.2 billion was stolen through fraud in the UK in 2022, incidents of cyber-attacks are on the up – the financial services industry reported a threefold increase in security breaches to the ICO in 2023, and ransomware attacks are at record levels with criminals compromising data on over 5.3 million people last year.
We should all be concerned about this and regulators, business, technology & data companies across the supply chain all have a collective role to play in building stronger resilience.
Regulation and Guidance
There is direct general, and specific regulation within the UK. However, businesses that are involved as financial services providers, Public companies, Telecoms operators, other essential services operators, digital service providers, accountants, lawyers and pension trustees should closely consider their own regulatory frameworks.
10 steps to cyber security
Back in the less complicated twentieth century, Eddie Cochran and Showaddywaddy may have sung about the “Three Steps to Heaven” but in today’s cyber-alert world, there are 10 recognised steps to reducing cybersecurity risk.
- Risk Management: Assessing the threats, opportunities, and risks, to determine the most appropriate way to protect technology systems, information, and data.
- Network security: protecting networks from attack and defending the network perimeter, for example by filtering out unauthorised access and malicious content. Properly configuring devices and filtering malicious traffic.
- Secure configuration: keeping systems up to date, removing unnecessary functionality.
- Managing user privileges: controlling access and monitoring activity.
- Educating users and increasing awareness: undertaking training on cyber risks for all users.
- Incident management: introducing and testing response and recovery policies.
- Malware prevention: actively scanning for malware and implementing policies on risks (such as removable media).
- Monitoring and testing: monitoring inbound and outbound traffic and looking for trends indicating threats or compromised data.
- Removable media controls: introducing policies on media and always scanning before use.
- Home and mobile working: introducing secure remote working policies, providing training on remote usage and installing networks for remote and mobile working.
Cybersecurity is not just about the board and senior management team – Governance Risk & Compliance
To maintain effective cybersecurity businesses need to do a lot more than simply implement technical measures such as antivirus software and firewalls. Businesses must treat cybersecurity risks as any other strategic-level risks, and it should be a board level responsibility, including Non-Executive Directors.
And while boards and senior managers should lead on the issue and have in place risk management frameworks that are championed by senior management teams, colleagues at all levels must also be “cyber aware” and diligent.
Apart from following the 10 steps it is a good idea to check ISO compliance standards on information security and risk management. ISO standards are optional rather than mandatory, and you can choose to be certified under them.
However, while the ISO standards are not policed or enforced, failing to meet applicable standards may be indicative of a breach of applicable law or regulation. Often, as a result, supplier service contracts will require a supplier to evidence compliance with applicable ISO standards, and so are a pre consideration in procurement.
All this may seem daunting, but addressing, minimising and managing the cyber risk of your business is imperative.
You need not feel alone, nor should you go it alone, because professional advice is on hand to guide you and give you peace of mind.
Easy wins, such as a positive and immediate impact on insurance premiums, through to the bigger prize of increased retention of business – by evidencing that your systems and controls are sufficiently robust to ensure that if you are on the end of a cyber-attack, only peripheral and not protected data or information, would be accessible – are all achievable.
Scott Moncur is a senior legal director at Vialex
>Latest Daily Business news
Leave a Reply