Given the increasing frequency of major cyber-attacks and information thefts being reported in the news, most managers and business owners have a heightened sense of awareness and concern about their organizations’ information security. Since most of these attacks are conducted via various computer systems and involve access to data stored in digital forms, it is easy to assume that information and cyber security issues are mainly IT-related and, as such, that the IT department - either internally or externally - is responsible for addressing them.
As a result of such thinking, most middle market organizations have added information security to IT’s list of roles and responsibilities. But because IT often has limited resources, this has resulted in the department being focused - at best - on ensuring proper system patches and updates are applied to minimize the chances of a break-in to the organization’s computer systems. IT is often not involved in designing, monitoring, and evaluating critical business processes in order to assess their potentially inherent information security risks. The paradox: IT is expected to ensure safe, reliable, and robust technology support for key business processes, but it is not involved in functional business process decisions such as how inventory is managed or what the customer onboarding process should look like.
This line of thinking has resulted in increased risk, since addressing today’s growing cyber and information security threats requires an enterprise risk management approach at various levels and across the organization. It is important to understand that every step of a business process - from interactions with customers and vendors to internal operational and financial processes that require capture, maintenance, and utilization of sensitive data - is subject to security breaches in some shape or form unless proper safeguards and mechanisms have been put into place.
In order to ensure your organization has an effective approach for addressing the increasing risk of cyber-attacks, step back and take a broad look at your organization. Define all instances in which critical and sensitive data is being captured, who captures the data, where is it stored, how is it accessed, maintained, and shared, and the ramifications if it is compromised.
Once equipped with that knowledge, the next step is to assess your vulnerabilities and make sure you have the right safeguards in place to minimize cyber and information security risks to the organization. These range from IT-oriented mechanisms to business process controls, education, and management practices.
Given the rapid changes in threat vectors, there are no guarantees that your organization will be bulletproof from all potential breaches. However, by going through this process you can at least be more confident that you have taken prudent steps to minimize the risks for your organization and its stakeholders, who may be subject to litigation as a result of an attack.
Sassan S. Hejazi is a director with Kreischer Miller and a specialist for the Center for Private Company Excellence. Contact him at Email.
You may also like: