When it comes to organizational management, board members have their work cut out for them. Having to make decisions that can make or break the company’s future, a member of the board is responsible for everything that happens under the organization’s name. There are millions of businesses, family owned, small or medium sized, or giant multinational corporations, going for global marketplaces and adopting global standards using the internet. Cybersecurity is now becoming a paramount concern.
Cyber security is the risk of loss of valuable or confidential information due to theft, attack or weakness within the IT framework of a company. With a large number of companies resorting to virtual workspaces and organizational structures that enable them to have a global presence, the realization that this, in fact, makes the company vulnerable to hackers and hacktivists is uncommon. Being the board member of a company also includes the responsibility of ensuring informational and organizational security. Employing CEOs and IT directors with proven success in cyber security is one way to tackle this issue. Another way is to know the major threats, and proactively combat them using a pool of resources, from qualified personnel to state of the art security systems.
Following is a list of the top 5 security concerns that any board member should be on watch for:
Gone are the days when firewalls, and encrypted information accessible through passwords installed on the organization’s central computer, were the pinnacle of cyber security. With every system, server, and router in a company’s framework today being an access node for any third party, it is crucial that these nodes are well protected. An ICT system comprises of hardware, software, and data, as well as the personnel that uses them. It includes communication technology as well, which can be the driving force behind an organization’s success but can also be the cause of its downfall, due to hacking activities.
The first step towards ensuring organizational security is to run a vulnerability check over the ICT framework. A vulnerability check involves checking for vulnerable nodes and upgrading their safety to ensure no third party can easily access the system structure. A chain, after all, is only as strong as its weakest link.
Hackers hack into organizational mainframes for many reasons, from monetary gains through extortions, to non-monetary benefits in the form of state or non-state sponsored warfare. One major crime that falls within this category is the theft of data or classified information, which can include IP addresses, copyrights, employee information, or other sensitive information. Hackers can use this information for the purpose of extortion, by means of stealing IP addresses and employee records, or for building superior quality products by spying on competing organizations. Not only can this be a huge blow regarding product revenue, but it can also affect the reputation of organizational integrity.
Data theft can be combated by using private servers with restricted access to sensitive information. These servers must be accessible only by a trusted few members of the board and must be completely independent of the ICT framework of the organization.
One of the primary reasons for an organization being susceptible to hacker attacks is the activity of the company insiders. More often than not, members of an organization unknowingly install malware, viruses or Botnet malware that initially compromises an individual system and later on the network; it is connected to and thus topples the organization’s IT framework. Though these are unintentional in nature, they still successfully cater to the requisites of the hacker and compromise the network. Intentional access by insiders is a problem on a whole other level since these ‘insiders’ might be spies or hacktivists, planted into an organization for the purposes of cyber espionage.
One way to combat this kind of threat in an organization is to ensure that the ICT systems use an admin controlled firewall which does not allow any installations, whether online or offline, without prior permission from the admin. The administrator can be the CIO or IT director of the organization, thus ensuring that potential cyber-spies do not have access to administrative rights. Intentional access to private information can be solved by using encrypted levels within the organization network. This way employees can access information on a strictly ‘need to know’ basis, isolating their rights from accessing privileged or private information.
The components of an ICT system, be it hardware or software, must be acquired by the company at some point in time. Acquisition can take place while setting up shop or while upgrading the existing system, and is one of the times when the overall organizational framework is most vulnerable to attacks from third parties. Supply chain malware includes viruses or other network compromising elements that are added to a system at the time of installation, upgrade, or acquisition. One of the biggest threats of this form of hacking is that the malware can lie in a dormant state initially, and be activated later on at an unsuspecting time, taking the organization by surprise.
Supply chain vulnerabilities can be combated by opting for agencies with a reputed and certified modus operandi. Ensuring that the CIO or IT director remains present during the time of installation or upgrade can thwart potential hacking attempts.
Zero-day vulnerabilities are threats to an organization’s framework and security which were previously unknown. These are unquantified cyber attacks which use no known tools, so countering them can be an issue in itself. The beginning of hacktivism at the time of the presidential elections is an example. Hacktivists have with political inclinations, and they use tools that include professional firewall crumbling codes and amateur algorithms. To establish a security check against such attempts can be an issue.
Zero-day vulnerabilities can only be combated by keeping a vigilant watch, and proactively monitoring system frameworks for attacks.
Though Cybersecurity threats that lead to data leakage and theft of privacy data are rampant, some measures can be taken by the organization to prevent or minimize their effects. Raising Cyber awareness within the organization through training, workshops, and classes that educate employees about cyber threats and its effects is helpful. Additionally, board members are wise to govern and monitor employees and their activities at all times. Governance can be achieved through readily available monitoring software designed to track employee actions, and flag potential breaches.
