Playbook: Everything you need to know to reduce your risk of a cyber breach

Identity/access management

A growing number of organizations rely on digital identification (i.e., digital IDs) to ensure only authorized users can access their services. However, this often requires gathering and collecting personal information — sometimes including biometric data such as body measurements, fingerprints, etc. It’s imperative such organizations establish a standardized framework of trust and security, as well as clear rules, ethics, and governance around collecting and storing this sensitive information, such as: 

Device compatibility
Many individuals and organizations use different digital ID devices and software, which can lead to compatibility issues. For instance, different devices often come with different levels of security controls or different capabilities for the deployment of these controls. It’s critical to ensure applications are compatible with all relevant devices and have robust security measures to protect individuals’ privacy.

Robust technology
The technology underpinning digital IDs must have an extremely narrow margin of error — especially those utilizing biometric data. Common issues persist which may lead to false positives and negatives, both of which can limit the functionality of digital ID platform and lead to security breaches and/or workarounds which negate the technology’s utility.

Tiered access
Organizations that use digital IDs have a responsibility to keep sensitive user data secure. While a central digital source of information offers convenience for both organizations and individuals, there’s also tremendous risk. Individuals’ biometric markers are immutable, so security breaches can have catastrophic (and potentially irreversible) consequences.

Organizations must create and implement defined privacy and security procedures — and comply with all relevant privacy regulations — to protect user data from unauthorized access. A tiered access framework can help organizations reduce the amount of people who have access to the information and thereby reduce the associated risks of a breach.

A policy built around the data lifecycle
Organizations must consider the steps they’re taking to protect data throughout its entire lifecycle and make this information readily accessible for all relevant stakeholders. This includes how and why data is gathered, stored, and secured — as well as when, how, and why it’s ultimately deleted or purged. Such measures should be clearly defined (and rigidly followed) in comprehensive policy and procedural documents which are continually updated as practices or technologies evolve.

Learn more:
How to get digital ID management right

Cyber governance

Cyber governance is a critical element of a proactive cyber defence plan. It outlines all the policies and processes surrounding how an organization will detect, prevent, and respond to cyber incidents. Senior leaders must create a culture and policy framework that effectively manages and mitigates cyber and privacy risks. A top-down commitment to cyber defense makes it easier for every individual in the organization to understand their role in preventing, reporting, and responding to a cyber breach.

Seven principles of cyber-focused leaders:

1. Cyber risk is enterprise risk: Technology is inseparable from the business. Incorporate cyber and privacy concerns within enterprise risk planning (e.g., through a risk register) to understand the likelihood and source of a potential breach — and steps to take to reduce its harm to the organization.
2. Cyber risk requires cyber perspective: Invite cyber security experts to advise on cyber topics and regularly include cyber and privacy on the leadership agenda. Create a technology committee to discuss priorities, trends, concerns, and emerging controls.
3. Cyber risk management begins with policy: Create and promote a culture of cyber incident prevention by emphasizing privacy protection, good technology hygiene, and risk awareness throughout the organization.
4. Cyber risks have legal implications: Be aware of any legislative changes, compliance or regulatory needs, and legal cases pertaining to privacy, cyber security, reporting guidelines, and repercussions for businesses that experienced a cyber breach.
5. Cyber risks and attacks are always evolving: Focus on the fundamentals and strive for excellence in cyber maturity. Stay on the lookout for new breach techniques, incidents, and risks; especially those occurring within your industry or sector.
6. Cyber risks are not all equal: Know which cyber risks you want to avoid, need to mitigate, or are willing to accept or transfer through cyber insurance — along with your strategy for each.
7. Data collection and privacy need a policy: Be aware of the data you collect and stay on top of new and existing regulations in your jurisdiction(s). Be conscious of what stakeholders know and want — and invest in policies that consistently exceed their expectations.

Learn more about the collection and management of personal information:
Beyond Regulation Whitepaper

Cyber awareness

Employees are the first — and in many ways, the best — line of defense against cyber breaches. Yet, businesses often fail to provide the training and tools to build and harness their capabilities. Fortunately, there are several steps you can take to strengthen your cyber training program and reap better results:

Make it personal
Introduce awareness programs that relate workplace security practices to a benefit in your employees’ personal lives. Demonstrating how strong, secure passwords and avoiding unsolicited links can protect their personal assets will transform how they view employer policies and procedures.

Make training engaging
Attention and information fatigue are real concerns for today’s workforce. Just because employees comply with mandatory training doesn’t guarantee they will fully engage with the information or absorb the desired key learnings. Rather than bombarding them with volumes of information, seek instead to make security awareness relevant and integrate it within their day-to-day work and the broader culture of your organization.

For example, you could run a simulated phishing exercise to reveal how many employees would click on a malicious link sent by email. Each employee will receive a tailored report card based on their performance along with a concise training module that directly speaks to their knowledge gaps. The results will be timely, personalized, and deliver tangible feedback on how their specific actions link to a potential security breach. Such exercises could be tailored to a variety of breach scenarios, roles, and authority levels and run indefinitely.

Encourage rather than penalize
Many organizations continue to preach perfection in their security training and often threaten employees with discipline or dismissal for actions leading to security breaches. Not only does this approach do little to curb malicious actions, but it may cause even more harm by making otherwise honest employees think twice about reporting an incident they had a hand in facilitating.

The cost and damage of a breach is generally proportionate to the length of time it takes to detect and address the threat. When IT and security departments react to reports with encouragement rather than antagonism, employees become part of the solution. The benefits are two-fold: Relevant professionals get the information they need to identify the source and mechanics of a breach and fix the problem, and the employee is more confident and likely to speak up if they suspect a problem.

Learn more:
How to build an effective cyber security employee awareness program

• Step 1
  Develop the assessment framework you will use. This could include:
  • Regulatory requirements (e.g., the Office of the Superintendent of Financial Institutions (OSFI), Payment Card Industry (PCI), etc.)
  • Relevant standards or policies (e.g., ISO 27001/2)
  • External assessment criteria (e.g., contractor requirements, reputational impact, etc.)
  • High value assets in your organization (e.g., proprietary information, sensitive personal or payment information, etc.)
• Step 2
  Conduct workshops with business stakeholders to identify your third-party service providers.
• Step 3
  Develop standard reporting templates to ensure consistency across vendors.
• Step 4
  Identify and recommend tools such as risk-based third-party cyber security assessments to help quantify the risk.
• Step 5
  Review your program with the right stakeholders and adjust it as necessary.
• Step 6
  Perform third-party risk assessments based on vendor risk levels (i.e., high, medium, low), with vendors at high risk levels requiring more extensive and frequent assessments.
• Step 7
  Collect information from vendors
  • Notify and engage your vendors. Open communication and understanding can lead to greater cooperation.
  • Assess third parties through questionnaires or passive risk tools.
  • Gather information from vendors using an adaptive and agile approach (e.g., self assessments, clarification questions, evidence gathering, and additional testing if required).
• Step 8
  Analyze the results to rate vendors, identify gaps, and build in improvements as required.

On each side of the triangle is a critical cyber security element: practice, regulations, and strategy. Without representation from all three sides, the program is incomplete.

Controls Assessment
Generally, this involves a cyber security audit or self-assessment against one of numerous frameworks (e.g., NIST, CIS, ISO, PCI, etc.).

Risk Assessment
This involves determining your organization’s overall risk tolerance and identifying potential cyber security threats:

• Within your industry;
• Related to specific technologies your organization uses;
• Facing organizations of your size and organizational structure;
• Resulting from your cyber security structure.

Maturity Assessment
This determines the effectiveness of controls, considering both the technology and human factors, as well as the decision-making abilities of key stakeholders in your organization.