Six Ways Cyber Security Leaders Can Manage an Evolving Threat Landscape

• How sensitive is the data we store?
• What types of compliance regulations apply, and what are the consequences for non-compliance?
• How are customers likely to respond to a breach?
• How competitive is our market?

The flip side of your risk appetite is your risk profile — how exposed you are to risks and changes within the threat landscape. A complete risk profile includes your risk posture, and an analysis of your overall operational exposure to risk. But a more basic understanding simply looks at how known factors will impact your priorities and the risks that are most likely to be a problem.

How this helps:

2. Use flexible frameworks

How this helps:

3. Response Planning

37% of UK companies have reported a data breach to the ICO in just the last twelve months. Accepting the reality that a breach might occur and building a set of protocols to respond is central to managing an ever-changing threat landscape. Cyber security isn’t about guaranteed safety — it’s about risk mitigation. Having a response plan is part of that strategy. There are three components to this:

1. Disaster recovery and business continuity: You don’t want to lose data, even if you lose control over that data. An effective DR (disaster recovery) and BC (business continuity) plan should already be part of your overall IT strategy. But don’t underestimate their value to cyber-preparedness. As just one example, cyber-attacks might be up 400% in 2020, but ransomware attacks are up 800%. A siloed DR backup could help you sidestep that vulnerability, even after penetration. 
2. Threat response: You need the technical and human resources available to act if something goes wrong. Threat response should deploy advanced monitoring tools to identify an attack, incident response capabilities to shut down the attack in real-time, and forensic support to step in and backtrace the problem — closing the door that left you vulnerable in the first place.
3. PR and communications: The public reaction to a cyber-attack can be just as damaging as the attack itself. Having a plan for how to communicate to your customers after an incident can make all the difference when it comes to mitigating business harm.   

How this helps:

Preparing for the worst-case scenario will help you manage that threat when it occurs. You will minimise the harm caused and create a more secure outcome. It will also help prevent a breach in the first place. In preparation, you will identify vulnerabilities, quantify the consequences of failure, and improve your ability to communicate the importance of effective cyber security planning.

4. Ensure access to resources

In order to execute your strategy and respond to risks you’re going to need skills, people, funding and support. We are going to talk in more detail about cultural support and training in the next point. Here, we want to focus on your own team, and the two critical components that you need to manage. 

1. People and skills:

65% of organisations report a shortage of skilled cyber security staff. Without the right professionals, you won’t be able to: 

• Build robust systems: You need access to the technical expertise required to build and maintain a robust cyber security architecture. 
• Train other staff: Making sure that everyone in your organisation understands cyber hygiene and how to access the system safely is critical.
• Respond to an incident: You need talent on call to respond to threats (either active or passive), resolve the risk and update your systems.

There are two halves to securing the right skills for the job. First, create an ongoing recruitment programme and bring in talent when needed. Second, establish one or more relationships with managed service providers.

The right strategic relationships can deliver you access to on-demand skills when necessary. This could mean outsourcing large parts of your cyber security operations. However, simply maintaining an ongoing relationship with a managed service provider will make it far easier to scale up access to cyber security professionals on a project (-or incident)-specific basis. 

2. Funding and support

People and technology cost money. If cyber security is not taken seriously by leadership, it will be an uphill battle to secure the funding necessary to build the team you need to manage evolving threats. You need to secure that support, and we believe the best way to do that is through demonstrating the value of cyber to business outcomes.  

Cyber security is often viewed as a cost centre — it’s an expensive requirement. Cyber security leadership is about changing that cost narrative into one focused on opportunities. You need to communicate to the board and C-suite that effective investment in proactive cyber defence will enable your business to pursue growth and achieve a competitive advantage. 

If you want to learn more about effective cyber security communication strategies, check out our free resource — Board Presentation Toolkit: Cybersecurity and Threat Management.

How this helps: