Cybersecurity: Five Tips to Ensure You’re Prepared
Cybersecurity: Five Tips to Ensure You’re Prepared
During the first year since Australia’s Notifiable Data Breaches (NDB) scheme was rolled out in early 2018, there have been 964 data breaches reported.
1. Identify What Is Important
There are two key, organisational assets that can help as you establish or refine your cybersecurity programme. The first asset is a data map that identifies and classifies the organisation’s data. What and where are the crown jewels, the most important data? What data do you have that, if compromised, will require a breach notification to satisfy regulatory or contractual obligations? What is your data attack surface? All these questions are more readily answered with the use of a data map.
The second asset is a business impact analysis. This identifies key business processes, their related systems and the impact if they are degraded or unavailable. If your website or email server go down, what is the impact? What about a file server? How long can you survive without your most vital systems before the impact becomes intolerable? Is there a third party whom you depend on for an important process?
2. Assess Your Current State
Based on your key data assets and critical business functions, you can now perform a risk assessment and evaluate your security programme to find the gaps and weaknesses in your current controls. The actions you take will depend on your organisation’s unique situation but should include an ongoing programme of risk assessment and refinement that aims to consistently improve your security over time. Resources like the CIS Top 20
Your assessment should also examine the risk introduced by your vendors and subcontractors, as well as the adequacy of any cybersecurity insurance you may decide to carry.
3. Make a Plan
Every organisation should have an incident response plan to guide critical actions in case a security incident or breach occurs. However, a recent survey shows one in four Australian businesses don’t have a plan in place,
4. Training and Practice
Cybersecurity is a business problem, not an IT problem. The entire team needs to be involved in protecting the organisation from cyber threats. Stakeholders should know about the procedures you have in place and the steps they need to take when an incident occurs. Cybersecurity training not only shores up your defences on the front line, but also means a quicker response and less exposure if an incident does occur. Currently one-third of Australian law firms don’t invest in cybersecurity training,
Third-party testing and a company-wide dry run – simulating an actual incident – is a best practice to ensure your security and incident response procedures are well designed and up to date. These exercises can be applied to incident response plans, disaster recovery plans and data privacy scenarios, validating your processes and verifying compliance to regulations and industry standards.
5. Follow Your Plan
You can’t control when an attack will happen, no matter the size of your organisation (43% of attacks are on small businesses).
Activities under your incident response plan should serve to stop the attack and mitigate the damage. The extent of the incident and the data and systems impacted must be determined. If necessary, the appropriate regulatory bodies, individuals and business partners should be notified.
6. Conclusion
The steps outlined above can help you prevent and prepare for a cybersecurity incident. Proper security and preparedness is a process, so these steps should be revisited regularly and adapted to changes in the organisation.
TransPerfect’s Information Governance practice group supports law firms and corporate legal departments with pre- and post-breach technical and governance services, including incident response planning and virtual CISO programmes. To learn more, visit our Information Governance page.