Beating Cyber Disruption Means Getting Back to Basics

Cybersecurity is as important for protecting businesses as buying home insurance is in typhoon-prone areas. Security breaches are a reality of business that many company leaders would rather avoid. Attack methods and technologies to stop it have become more sophisticated with every passing year. The pandemic has heightened awareness of cybersecurity threats as companies adopted new technologies rapidly and corporate networks were suddenly being accessed from outside the company’s firewall on employees’ personal devices. 

Yet, as we learned from a recent conversation with Benjamin Ang, a senior fellow at Nanyang Technological University, cybersecurity remains underfunded or overlooked in the grand scheme of what is required to protect an enterprise and generate growth. Ang spends his time  looking at cyber issues from a 10,000 ft view. He digs into the policy aspects of international and national cybersecurity to increase understanding of how disinformation online, international cyber or nation state attacks, and the security of advanced technologies disrupt the real world. From this perspective, the reasons for nations, enterprises and individual consumers securing their data and systems within networks become clear.

However, if you read the business news regularly, you may come away with a picture of a high stakes war with invisible threats and a global talent shortage to address it. Enterprises continue to underspend on areas that may protect them most. Although 47% of Asia-Pacific executives reported in a survey that they plan to increase data security spending in the next 12 months, it comprises less than 15% of typical IT security budgets. The primary focus remains on network security for 37% of enterprises followed by data and application security. Additionally, the consequences of not notifying the public quickly about incidents are escalating – at least in Europe. Yet, Benjamin’s response to that is to offer good news; protecting your business is not as complicated as it seems.

In his view, not enough businesses are implementing practices to be aware of the risks, ensure proper access to IT networks and keep employees trained to reduce the success of breach attempts. The current environment has also led some company leaders to cut corners when it comes to what they perceive as non-core expenses. Their timing could not be worse. Cyber threats and incidents have intensified with attackers adapting to people’s fears around COVID-19 and exploiting vulnerabilities brought to light by digitalisation. 

Managing cyber disruption

Ang cautioned that leaders holding their business together in this manner need to enter a new phase. That includes getting back to some basic tenets of security by making sure that all employees working at home are provided with the right devices and are thoroughly educated about cyber risks on a continual basis.

“Giving your employees devices and proper access actually makes them more productive, and can also help the bottom line. If your employees are often on calls, but they are in a noisy home environment like most of us are with kids or other family members working from home, can you provide them with a headset and a mic so that they can make a sales call properly? Maybe that helps them to close the deal. Can you provide them with a computer that is going to allow them to pull up the information faster because it’s not creaking at the seams or doesn’t keep crashing out of Zoom calls? These things will in the end, add up.”

It also means helping your employees access the corporate network safely. Ang noted that companies can guide employees in setting up a safe Wifi network at home, but should also consider other places employees may set up their laptop to work.

We can’t take it for granted that everybody’s got the access to be able to do things from home.

If your employees are escaping noisy homes to get some work done at a cafe or to get a reliable internet connection, they could be putting your company at greater risk. Benjamin said business owners should consider what documents their employees are accessing from public places.

“Should your employees be working on confidential documents where everybody can just walk by and see it?”

Despite the potential threats, Ang said business leaders who think about these factors when protecting their company’s data are in the minority. Even large enterprises are still guilty of setting basic passwords to servers in spite of the amount of information available explaining why setting strong passwords is important.

“You can avoid certain more basic things like having unsafe passwords, or employees sharing passwords around, or having passwords in a visible place. These kinds of things still matter, because it is terrifying how many breaches happen because of these basics.”

Benjamin recommends that business owners devise a security backup plan and invest in more IT hardware with the guidance of security experts, especially if there is no dedicated expert on staff. These steps pay off in the long run because your business is not helpless if a breach occurs.

“You either pay upfront, or you pay later when customer data is stolen, there is a ransomware attack, or you get fined from the Personal Data Protection Commission for a data leak. Then your business grinds to a halt for a day, two days, a week, which could actually wipe out some businesses.”

We know that cyber threats will continue to loom over enterprises, especially with the accelerated pace of digitalisation. Establishing or reinforcing basic security processes can mean the difference between focusing on growing your business or facing the consequences of a successful attack.

Recommended reads: Benjamin recommends reading the Singapore Cyber Landscape, which is published annually, and the Safer Cyberspace Masterplan from the Cyber Security Agency of Singapore (CSA) to know the risks and gain insight on how to reduce it.
https://www.csa.gov.sg/news/publications