Cybersecurity is a topic every business leader is concerned about, yet many aren’t fully involved in the process; after all the IT department should be handling it right? But cybersecurity is also a leadership issue, not just a technical one.
There is a difference between thinking that IT has it “handled” and knowing that it is. It’s when your operations grind to a halt. Your customer data is gone. The phones are ringing. That’s when the rubber hits the road.
If you are the CEO, MD or GM, you are the decision-maker in a cyber crisis. You are the one client’s expect answers from, your team looks to when systems are down, and the one the board or owners hold accountable for recovery.
It is up to you to drive your cybersecurity plan; because it is not a technical problem, it’s a strategic, financial and reputational risk that sits squarely on your shoulders.
“If you are not asking what your cyberattack game plan is, you are the weakest link in your IT security chain,” says Warren Bonheim, Managing Director of Zinia, a leading technology group and Managed Services Provider. “Cyber risk is now a business risk, and if you treat it as anything less then you are exposing your company to potential disaster.”
“Business continuity underpins your operational and strategic goals. That’s why a cyber game plan must be a key part of your business strategy, encompassing the people, processes and systems required to ensure resilience.”
Here are 6 questions you should be able to answer today:
- Do we have a cyber incident response plan, and has leadership reviewed it?
- Do we know what to do in the first 30 minutes of an attack?
- Have we done a cyber drill with our executive and comms team?
- Have we trained employees on basic cyber hygiene (passwords, phishing, MFA)?
- What is our stance on ransomware payments, and have we reviewed this with our legal advisor?
- Are our backups isolated, tested, and recoverable within hours?
- How do we demonstrate to clients and stakeholders that we take cyber risk seriously?
Bonheim advises that if you are unsure about any of the above, you cannot afford to wait any longer; you need to be better prepared.
“You don’t have to be a large company to be targeted by cybercriminals. In fact, medium-sized businesses are often the easiest to breach, because they are just digital enough to be vulnerable, but not mature enough to be fully protected,” he says.
Here are his top 5 cyber leadership tips:
- Your main cyber “job” is to provide strategic oversight, not know every technical detail. No one expects you to understand ransomware payloads or endpoint detection and response software. However, they do expect you to ask the right questions, and that often means challenging assumptions.
- Make sure there is a written, cyber incident response plan that has been tested in a mock scenario. It should cover who does what, when and how – outlining roles, responsibilities, timelines, key contacts and escalation steps. In a crisis, speed is everything, so make sure you are fully prepared.
- Cybersecurity isn’t a once-off audit, it’s an ongoing process, and someone needs to own it. You must assign responsibility internally or through a trusted MSSP (Managed Security Service Provider). Make sure you schedule quarterly security reviews to get updates on risks, incidents, emerging threats, compliance, and recovery readiness.
- It is also up to you to drive a culture of awareness. After all cyber resilience starts with people. Ensure that your employees are trained and know how to spot phishing attempts, use strong passwords, enable MFA (multi-factor authentication), and report suspicious activity quickly.
- Review your backup and recovery strategy. It is all very well to know that backups are in place, however have they been tested? Can you be 100% certain that core system data can be recovered quickly and files are not corrupted? Don’t assume it is handled, ask for a demo or walk-through so you have complete peace of mind.
Bonheim concludes, “While cybersecurity is often approached as a compliance checkbox or technical upgrade, the truth is that cyber resilience starts with you – the leader. The threat is real but so is your power to be ready. Ask the tough questions, be proactive, and lead your business from risk to resilience.”
Intimidating Presence
Anton Rupert – Dr. Anton Rupert founded the Rembrandt Group in the 1940s. After initially focusing on the tobacco industry (Peter Stuyvesant), his company soon moved into industrials and luxury goods. Rembrandt has since been split into Remgro (an investment company with financial, mining and industrial interests) and Richemont (a Swiss-based luxury goods group). Rupert was also a founding member of the WWF (World Wildlife Fund) in the 1960s. His son Johan has since turned Richemont into one of the largest luxury goods companies in the world.