Cybersecurity Insights: How to Protect Your Information Assets

Invest In Training

Effective cybersecurity training is an important, but often overlooked element of your business’ GDPR and ISO 27001 compliance regimes. Getting it right requires more than just the occasional presentation or online course and exam. Your cybersecurity training needs to influence behavioural change, and the only way of truly driving this is through top-down board-level engagement.

Partner with a cybersecurity specialist and carry out behavioural analysis through workshop sessions. On the basis of findings from these workshop sessions, carry out targeted training on a ‘little and often’ basis. Include security at home, adding value for users and extending the cybersecurity conversation beyond the office. Remember, security professionals are not the bad guys – they should be integrated as part of business as usual, and they should always be helpful and approachable.

Manage Your Third-Party Suppliers

Supply chain compromises are a key threat vector for most businesses. You may control your own data, but when you pass it on to third party supplier contracts, and they subcontract again to their vendors and suppliers, you may well lose visibility and control over where your data is being stored and how it is being used.

Carry out a robust assessment of all suppliers that handle personally identifiable information (PII) through an annual questionnaire. This should cover their entire business, and should comprise the first step of any procurement process along with a request to see evidence of secure practices through a right to audit.

Use Encryption

At a high level there is little to add to the FCA’s advice around encryption; not all data requires the same level of protection, so apply encryption controls appropriately for each level of data classification. Apply risk management principles to determine the potential impact of any data being exposed, and remember that when systems are highly interconnected and interdependent, you are only as strong as your weakest link.

Be Aware of Your Vulnerabilities

In order to be aware of your potential vulnerabilities, you will need to carry out regular vulnerability scans overseen by a governance committee. Establish provisions to apply patches on both a scheduled and emergency basis, in order to ensure that you can address security flaws as soon as vendors release remedial patches.

Back up your vulnerability scanning with regular independent penetration testing. In an ideal world, penetration testing should take place every time there is a significant change to your IT infrastructure – whether it’s adding an application server, updating your remote access method or any change that affects your network topography. Security should be built in from the start, with penetration testing carried out prior to go-live.