As featured in Security Magazine (data drawn from AON 2019 Cyber Security Risk Report)
2018 showed that a proactive approach to cyber preparation and planning paid off for the companies that invested in it; it’s expected that in 2019 the need for advanced planning will only further accelerate. “Digital Transformation” is here to stay – organizations of all sizes are embracing progressive ways to leverage technology to better position themselves within their respective industries. This movement must also be accompanied by a thorough Cyber Threat Management plan that’s updated regularly.
AON’s recent report focused on eight specific risk areas that companies may face in 2019. The risks illustrate how, as organizations transition to a digital-first approach across all transactions, the attack surface expands rapidly and sometimes in unexpected ways. In other words, thanks to the rapid enhancements and constant changes in technology, the number of touch-points that cyber criminals can access within a business is growing exponentially.
The eight risks include:
- Technology – While technology has revolutionized the way organizations today conduct business, broader and wider-spread use of technology also brings vulnerabilities. From publishing to automotive, industries are facing new, evolving services and business models. These new opportunities however, bring a radically different set of risks, which organizations will need to anticipate and manage as they continue the digital transformation process.
- Supply Chain – Two prevailing supply chain trends will heighten cyber risks dramatically in the coming year: one is the rapid expansion of operational data exposed to cyber adversaries, from mobile and edge devices like the Internet of Things (IoT). The other trend is companies’ growing reliance on third-party—and even fourth-party—vendors and service providers. Both trends present attackers with new openings into supply chains, and require board-level, forward-looking risk management to sustain reliable and viable business operations.
- IoT – IoT devices are everywhere, and every device in a workplace now presents a potential security risk. Many companies don’t securely manage or even inventory all IoT devices that touch their business, which results in breaches. As time goes on, the number of IoT endpoints will increase dramatically, facilitated by the current worldwide rollouts of cellular IoT and the forthcoming transition to 5G. Effective organizational inventory and monitoring will be critical for companies in the coming year and beyond.
- Business Operations – Connectivity to the Internet improves operational tasks dramatically, but increased connectivity also leads to new security vulnerabilities. The attack surface expands greatly as connectivity increases, making it easier for attackers to move laterally across an entire network. Further, operational shortcuts or ineffective backup processes can make the impact of an attack on business operations even more significant. Organizations need to be better aware of, and prepared for, the cyber impact of increased connectivity.
- Employees – Employees remain one of the most common causes of breaches. Yet employees likely do not even realize the true threat they pose to an entire organization’s cybersecurity. As technology continues to impact every job function, from the CEO to the entry-level intern, it is imperative for organizations to establish a comprehensive approach to mitigate insider risks, including strong data governance, communicating cybersecurity policies throughout the organization, and implementing effective access and data-protection controls.
- Mergers & Acquisitions (M&A) – Projections anticipate that M&A deal value will top $4 trillion in 2019, which would be the highest in four years. The conundrum this poses to companies acquiring other businesses is that while they may have effective cybersecurity for themselves, there is no guarantee that their M&A target has the same approach in place. Dealmakers must weave specific cybersecurity strategies into their larger M&A plans if they want to ensure seamless transitions in the future.
- Regulatory Compliance – Increased regulation, laws, rules and standards related to cyber are designed to protect and insulate businesses and their customers. The pace of cyber regulation enforcement increased in 2018, setting the stage for heightened compliance risk in 2019.
- Board of Directors – Cybersecurity oversight continues to be a point of emphasis for board directors and officers, but recent history has seen an expanding personal risk raising the stakes. Boards must continue to expand their focus and set a strong tone across the company, not only for actions taken after a cyber incident, but also proactive preparation and planning.
For more information on how to protect your organization, contact Chris Mangano, Vice President of Sales & Marketing, Mercadien Technologies at 609-689-2339 or firstname.lastname@example.org.