How to stay prepared in a world with 12 cyberattacks per second

The protection of information assets and their importance to business success and health

It is a fact that few would dispute that information assets are among the most valuable assets for businesses. Without their customer database, order records, stock control in warehouses, invoicing records, communication with customers and suppliers, or the design and description of the products that give them a competitive edge in the market – amongst other things – they would struggle to operate or even survive.

In the context of information security, an asset refers to any data or system related to the processing of that data, defined and managed as a single unit that can be understood, shared, protected and utilised efficiently. Information assets have value, risk, content and life cycles that can be assessed and managed; therefore, their protection is essential. There are various categorisation systems, although for the sake of simplicity, one fundamentally useful distinction can be made:

• Tangible: a person, a computer, a smartphone or a server.
• Intangible: a database, an email or data relating to colleagues and customers

Causes of data loss

Numerous studies indicate that there are various causes of data loss in organisations. Specifically, the ‘2016 Cost of Data Loss Study’ conducted by the Ponemon Institute, based on a survey of 383 organisations worldwide, it was concluded that 48 per cent of incidents are due to malicious actions or cyber-attacks involving viruses and malware in general, 25 per cent are caused by human factors, and the remaining 27 per cent are due to system errors, including IT and business process failures.

Cost of data loss

According to the “Global State of Cybersecurity Survey”, compiled by the consultancy firm PwC, losses incurred by Spanish companies resulting solely from cyberattacks are estimated to have averaged around 1.4 million euros in 2016. If we focus specifically on SMEs, the insurance company Mapfre, drawing on various studies, puts this figure at between €20,000 and €50,000 on average.

All these data breaches can entail a high cost for businesses, not only in terms of business disruption, but also in terms of damage to their reputation, loss of trust and even the loss of customers, as well as the cost of recovering the data itself. Although this figure depends on the company’s line of business and the sensitivity of the lost data, the same study estimates that the average cost of recovering a single data record following a cyberattack is €152. This figure is significantly higher than that resulting from system errors or human factors, estimated at between €119 and €123 respectively. These figures give us an idea of the significant impact it can have on a company to lose several thousand records of information that is sensitive to its business.

The risk in figures: 12 cyberattacks per second worldwide

In Spain, around 105,000 cyberattacks were recorded in 2016 – double the figure for the previous year and five times more than in 2014. Of these, almost 70 per cent were directed at small and medium-sized enterprises, as detailed in the ‘International Business Report 2017’ by the consultancy firm Grant Thornton.

How to prepare and protect yourself online

The question is therefore no longer, ‘Could this happen to me?’, but rather: ‘Will I be sufficiently prepared to be able to continue running my business under the best possible conditions when it does happen to me?

And the answer is yes, you can be prepared. Various security experts, including INCIBE itself and Grant Thornton, agree on the need to view security within the company as a whole and always in line with the specific needs of your business. They outline the implementation of a proper security policy around the following key areas:

• Properly analysing the business’s information needs, the criticality and importance of that information, and the risks to which it may be exposed.
• Develop the projects and initiatives to be implemented based on the priorities defined in the risk analysis.
• Involve and raise awareness of corporate security throughout the organisation, from senior management down to all employees, taking it beyond the technical aspect to the ‘human factor’.

All that remains is to truly recognise the importance of cybersecurity – or information security – for the company and to get down to work on it.

At EPUNTO Interim Management, we can help you. As interim managers with over 15 years’ experience, we have the knowledge and expertise needed to lead change in the direction and management of your organisation’s information systems information security.

My name is Santiago Muñoz; I am dedicated and passionate, with over 20 years’ experience in the implementation of ICT technologies, and I can help you prepare to tackle the risks of digital transformation. Shall we have a chat?