Would you gamble flipping a coin for the effectiveness of your cybersecurity plan? Heads: you’re able to prevent – or recover from – a cyberattack. Tails: you fall victim to a cybercriminal, lose critical business data, suffer immense business productivity and reputational losses — not to mention struggle to recover data and systems.
If that seems unthinkable, consider this: fewer than half of all South African respondents surveyed in Mimecast’s latest global State of Email Security Report have a cyber resilience strategy in place. And this is despite the 44% that say they believe they’ll experience a negative business impact from an email-borne attack in 2019.
Planning for the inevitable
In fact, the report found that nearly 10% of businesses believed a negative business impact was ‘inevitable’. What happens when that inevitability comes to pass? For 38% of South African firms that did fall victim to a cyberattack in the past twelve months, that negative business impact took the form of data loss; for one in five, it was damage to their reputation.
Twenty percent suffered direct financial losses, while nearly a third suffered business downtime that affected productivity and, potentially, profit.
This kind of disruption can have devastating consequences to the profitable running of a business. Look at the recent example of Johannesburg’s City Power, which fell victim to a ransomware attack in July. Suffering downtime from a cyberattack can have far-reaching consequences for organisations in the public and private sectors.
Revenue takes a knock. Trust is affected. Some never recover.
In a time when most IT leaders recognise it’s a matter of when – not if – they’ll be hit by a cyberattack, and the cost of a successful attack is potentially ruinous to your organisation, what can CSOs and CISOs do?
Building greater resilience
Organisations should strive for stronger cyber resilience. This means putting comprehensive security controls in place to detect and prevent cyber threats; powerful business continuity tools to maintain productivity during an attack; automated backup and recovery capabilities that quickly restore critical data and systems after an attack; and a focus on empowering employees with ongoing cybersecurity awareness training.
The combination of these elements provide protection before a cyberattack, minimises opportunities for human error to undermine security efforts, and reduces the time needed to recover while minimising data and productivity losses in the wake of a successful attack.
And it all starts with email. Email remains the number one business application and the most common attack vector for cybercriminals. Nine in ten cyberattacks use email as its primary channel of attack; and yet, organisations still don’t have the right measures in place to ensure this channel of communication is adequately protected.
Developing a comprehensive cyber resilience strategy should involve board-level buy-in, regular awareness training for all employees, and the correct mix of policies and technologies to provide protection before, during and after a cyberattack.
Building resilience together
On August 29th, IT and security professionals will come together to discuss strategies and share experiences of how we can build a more resilient world. The Cyber Resilience Summit is presented by Mimecast and will be held at the Sandton Convention Centre. Offering more than 16 sessions with multiple tracks covering cyber resilience, the regulatory landscape, technology innovation, security and more.
For more information and to register to attend, please visit www.cyberresiliencesummit.com/website/4569/home