Corporate Governance Cyber Security Report

This report discusses the critical need for cyber security in corporate governance, detailing the risks posed by cyber attacks and the importance of implementing a robust cyber resilience policy. It outlines best practices and recommendations for organizations to safeguard their digital assets and ensure operational continuity in the face of increasing cyber threats.

CORPROATE GOVERNANCE 2
Executive Summary
Cyber security is one aspect which is growing with in this digital age, due to the reliance on
work being conducted by the use of digital means. And with the high use of such digital devices,
the need for taking the requisite measures for protecting the company against cyber attacks is
gaining significance. This is important because the cyber attacks cause major damage to the
operations of the company, where they can lock the company employees out of the system,
use the funds of the company, spy on the company data and different other measures which
hurts the company. All this enhances the need for the companies to adopt a proper cyber
attack policy and to integrate the cyber security and resilience protocols in the day to day
working.
This report has been drawn up essentially to provide a comprehensive detail on the need for
the cyber security policy, along with the recommendations to adopt one for the company.

CORPROATE GOVERNANCE 3
Contents
Introduction...................................................................................................................................4
Need for Cyber Security.................................................................................................................4
Cyber Security and Resilience Protocols........................................................................................6
Best Practices.................................................................................................................................7
Recommendations for initiating Cyber Resilience Policy.............................................................10
Conclusion................................................................................................................................... 11
References................................................................................................................................... 13

CORPROATE GOVERNANCE 4
Introduction
The world is becoming highly reliant on internet due to the advent of the digital age. And so,
each and every work of an individual, including the big organizations is reliant upon the
internet, per se the digital means. Due to this reliance, there is a need to put proper safeguards
to protect the business being transacted through these digital means. The reason behind these
increase steps towards security of digital means lies in the high threats of cyber attacks. And
this presents a strategic challenge for the leaders of all the sectors where they are not only
required to take advantage of the technological advancements, but also have to counter the
cyber risks. There has been a rising misuse of technology posing a threat to cyber security and
innovative steps are required to counter these (World Economic Forum, 2017).
There is a need for the company’s board to identify and mitigate these risks and take the
requisite steps towards countering the risks arising from cyber attacks (Willson and Dalziel,
2015). Due to these reasons, a report has been presented here where the need for cyber
security, along with the steps required for drawing up a cyber resilience policy of the company
have been elucidated.
Need for Cyber Security
Before identifying the need of cyber security, there is a need to understand what the term
actually refers to. Cyber security can be defined as the security installed on the computers for
protecting the computer (or any other digital device on which it is being installed) from all types

CORPROATE GOVERNANCE 5
of theft of information, damage to software or hardware and even the disruptions and
misdirection of the services which the digital device presents. Included in the cyber security is
the safeguard against the harm, to the digital system, by accessing the network being, used by
the device, by injection of code or data, and even by overtaking the physical access to
hardware. Through the use of different techniques, the company’s security is tricked and is
made to go away from the security protocols which have been put in place (Kostopoulos, 2012).
For 2015, Forbes analysed the value of the worldwide cyber security market, which had
reached a landmark of $75 billion. Forbes did not just stop there and projected the value of this
market for 2020 at $170 billion, which is enough to show the rising threats of cyber attacks
(Tech Target, 2017).
For the organizations, the significance of cyber security is raised as the businesses have to bear
high costs for a cyber security breach. As the data of the company is misused, sold off in the
market and even monitored without the knowledge of the company, the costs of cyber security
breach prove to be a costly affair for the companies (Singer and Friedman, 2014). At times the
company’s own personnel are locked out of the system of the company, the finances of the
company are altered, and the confidential data of the company is leaked online. The attacks
which are used by the cyber hackers include click jacking, denial of services, spoofing,
tampering, phishing and the like. All this make it a necessity to take steps towards enhancing
the cyber security of the company (Graham, Olson and Howard, 2016).

CORPROATE GOVERNANCE 6
Cyber Security and Resilience Protocols
There is a growing need for the companies to integrate the cyber security and the protocols for
resilience for beating these cyber attacks. This is important for both the survival of the company
and for the company to perform well. There is a lack of a standard model for estimating the
costs of these attacks. However, the projected costs for cyber security, on the basis of the past
attacks have been projected at $2 trillion for the year 2019 (Morgan, 2016). Often, the data put
forward by the companies is taken to take the estimate of the same. Back in 2003, the loss
resulting from worm and virus attacks were estimated to be $13 billion and all over attacks
contributed to $226 billion (Cashell et al, 2004). And it can be easily stated that this figure has
manifolded with time.
“WannaCry” or “WanaCrypt0r 2.0” was a global Ransomware cyber attack which was totally
unprecedented and which recently hit more than 200,000 hospital, government agencies,
banking institutions, and different organizations in around 150 or more nations. This
Ransomware not only encrypted the data of the users, but also demanded a payment for
unlocking the data in bitcoins. There were a number of companies which took a hit due to this
attack and included in this was Telefonica, which is the largest telecom provider in Spain, over
16 hospitals in National Health Service of England, FedEx- which is a US based package delivery
company, and a range of high profile targets (MetricStream, 2017).
The cyber attacks across the globe are rising. The FBI was cited by the CSO magazine stating
that only in the first quarter of 2016, over $209 million had been collected as the payments for
Ransomware. The cyber attacks highlight the unpreparedness of the majority of organizations

CORPROATE GOVERNANCE 7
in countering the global menace of cyber security threats. This is also due to the fact that a
number of big organizations are still relying on the older version of softwares, which are usually
unsupported and are also making major delays in taking steps to patch up their vulnerabilities.
Along with these, these organizations are also not undertaking automated backups which
increase the risk of cyber attacks against them. With the rise in the magnitude, scale and the
impact of these attacks, it is important for the business leaders to take proper steps to diligently
address these threats and avoid the disruptions caused by them. And such incidents make it
crucial for the integration of cyber security and the protocols for resilience in the policies of the
company (MetricStream, 2017).
Best Practices
As per the “PwC Global Economic Crime Survey 2016” cyber crimes have taken second position
in the most reported economic crimes which affect around 32% of the organizations (PwC,
2016). This is because of the fact that the attackers are getting better and faster at what they do
and for making the threats stick; along with the struggle of the companies as they are
overloaded with the urgent security related tasks. For these purposes, different articles have
been presented whereby the best practices to be adopted by the companies have been stated.
But before these are covered, the steps taken by IBM for dealing with cyber threats have been
stated below (IBM, 2012).
It is the belief of IBM that by adopting the practical ways, a great improvement in the
management and execution of the cyber security for the entire organization can be attained.

CORPROATE GOVERNANCE 8
And so, the company has introduced best practices which can be implemented by any and all
utility organizations so as to safeguard from such attacks and even for the stakeholders to
understand the cyber security threats being faced by the company. As per IBM, the best
practices include, viewing the security as a risk management activity; the creation of a fully
integrated security enterprise; the implementation of the security by design; using the business
based security measurements and metrics; understanding that the change has to be initiated
from the top; and taking the action on the top ten recommended security actions given by IBM
(IBM, 2012).
 Performing third-party external and internal security audits in a regular manner
The networks have to be constantly changed so that when the security problem is
raised, it can be located before the hackers do. This can be done by regular third party
security audits for constantly assessing the vulnerabilities (IBM, 2012). Controlling the endpoints
There is a need be aware about and be in control of the total endpoints for securing the
infrastructure. There is a need to be aware of the software being used, the patch levels
and the configurations, along with identifying if the patch system is struggling due to
lack of custom code, resources or legacy code (IBM, 2012). Segmenting the sensitive systems and information
The companies have a lot of sensitive information which not only includes their
classified data, but also information about the employees and the clients. There is a
need to eliminate the unnecessary interconnectivity between the insecure networks and

CORPROATE GOVERNANCE 9
the sensitive data, especially when the organization is targeted by attacks which can be
best deemed as sophisticated (IBM, 2012). Protecting the networks
It needs to be clearly understood which parties use the network of the company and
who can access it freely. The instruction to prevention systems results in breaches and
the same has to be avoided (IBM, 2012). Auditing the web applications
The web applications scream of vulnerabilities and continue to be a common gap where
the attacks are done. Hence, there is a need to identify such vulnerabilities in the web
applications which can help in such attacks, before the attacks actually take place and it
does not matter if the application is in-house developed or has been purchased from a
third party (IBM, 2012). Training the end users regarding the spear phishing and phishing
The majority of sophisticated attacks have a spear phishing element or involves social
engineering. The attacks can be targeted on business systems, accounts or personal
accounts. Hence, the employees need to be made aware of such attacks and to raise the
issue as soon as a suspicion of the same is raised, instead of ignoring them (IBM, 2012). Identifying the bad passwords
One of the key causes of cyber attacks lie in the old or the bad passwords. the first line
of defence is the password and if that is weak, the work of attackers is eased. Hence,
there is a need to educate the employees regarding the same and adopt comprehensive
polices and user education (IBM, 2012).

CORPROATE GOVERNANCE 10
 Integrating the security in every project plan
There is a need to avoid such situation where the cyber security teams chase the
projects which have just been rolled out as this can lead to major security gaps in the
networks which can show up on the vulnerability assessment reports. Hence, there is a
need to apply the new projects from the very beginning (IBM, 2012). Examining the policies of the business partners
The cloud computing and complex outsourced is very common in the majority of
systems which are operated by the companies. The majority of insider attacks originate
from the employees who work for the business partners of the targeted companies; and
this is often referred to as corporate espionage (IBM, 2012). Having a proper and solid response plan
There is a need to effectively manage the sophisticated and targeted attacks as a
continuous process which involves identification of a breach and also responding and
investigation, along with learning and adapting to do so. There is a need for a strategic
target to be identified and looked for carefully, if the same is not identified (IBM, 2012).
Recommendations for initiating Cyber Resilience Policy
On the basis of the best practices adopted by IBM, certain recommendations can be drawn for
initiating the cyber resilience policy for the company. The very first recommendation is to adopt
the best practices which have been drawn by IBM. The other recommendations have been
stated below.

CORPROATE GOVERNANCE 11
 There is a need to use firewalls in the computers as they can protect the computers
from any attack (Phillips and Sianjina, 2013).
 There is a need for the cyber security policies to be properly documented and to proper
put on paper, the cyber security policy being adopted by the company (Bayuk, Healey
and Rohmeyer, 2012).
 There is a need to control the “Bring Your Own Device” at the workplace as these
devices use the network of the company, which can open the probability of the
company’s network being used by the cyber attackers (Moore, 2016).
 There is a need for the company to educate its employees regarding changing the
passwords regularly, and adopting the best practices being summarized here (LeClair,
2013).
 Regularly backing up the data of the company, so that in case of an attack, the data of
the company can be safeguarded (Donovan, 2017).
Conclusion
The discussion carried on above highlighted the very basics of the cyber security and the need
for the same for not only this company, but also for all the companies working in the digital era.
Due to the computers being interconnected and sharing in networks being a common affair, an
opportunity has been presented to the attackers to cause damage to the companies, in both
financial and other manners. The figures stated in this report, relating to the cyber security
threats and the money invested by the companies to steer clear of these attacks highlight the
magnitude and the gravity of cyber attacks and the need to be safeguarded from it. This makes

CORPROATE GOVERNANCE 12
it obligatory for the company to adopt a cyber security policy and to integrate the cyber
security and resilience policies in the company, so that effective steps can be taken to stop such
attacks so that the company can continue its work and also, improve upon its practices. The
recommendations given in this report need to be adopted by the company so that the cyber
attacks can be avoided.

CORPROATE GOVERNANCE 13
References
Bayuk, J.L., Healey, J., and Rohmeyer, P. (2012) Cyber Security Policy Guidebook. Hoboken, New
Jersey: John Wiley & Sons.
Cashell, B., Jackson, W.D., Jickling, M., and Webel, B. (2004) The Economic Impact of Cyber-
Attacks. [Online] Federation of American Scientists. Available from:
https://fas.org/sgp/crs/misc/RL32331.pdf [Accessed on: 10/09/17]
Donovan, K. (2017) 10 Best Practices for Cyber Security in 2017. [Online] Observe It. Available
from: https://www.observeit.com/blog/10-best-practices-cyber-security-2017/ [Accessed on:
10/09/17]
Graham, J., Olson, R., and Howard, R. (2016) Cyber Security Essentials. London: CRC Press.
IBM. (2012) Best practices for cyber security in the electric power sector. [Online] IBM. Available
from: https://www-935.ibm.com/services/multimedia/WR928534SF-
Best_practices_for_cyber_security_in_the_electric_power_sector.pdf [Accessed on: 10/09/17]
Kostopoulos, G. (2012) Cyberspace and Cybersecurity. London: CRC Press.
LeClair, J. (2013) Protecting Our Future, Volume 1: Educating a Cybersecurity Workforce. New
York: Hudson Whitman/ Excelsior College Press.

CORPROATE GOVERNANCE 14
MetricStream. (2017) Ransomware Cyber-Attacks: Best Practices and Preventive Measures.
[Online] MetricStream. Available from: https://www.metricstream.com/insights/ransomware-
best-practices-preventive-measures.htm [Accessed on: 10/09/17]
Moore, M. (2016) Cybersecurity Breaches and Issues Surrounding Online Threat Protection.
Hershey, PA: IGI Global.
Morgan, S. (2016) Cyber Crime Costs Projected To Reach $2 Trillion by 2019. [Online] Forbes.
Available from: https://www.forbes.com/sites/stevemorgan/2016/01/17/cyber-crime-costs-
projected-to-reach-2-trillion-by-2019/#53b93d2b3a91 [Accessed on: 10/09/17]
Phillips, R., and Sianjina, R.R. (2013) Cyber Security for Educational Leaders: A Guide to
Understanding and Implementing Technology Policies. Oxon: Routledge.
PwC. (2016) Global Economic Crime Survey 2016. [Online] PwC. Available from:
http://www.pwc.com/gx/en/services/advisory/forensics/economic-crime-survey.html
[Accessed on: 10/09/17]
Segal, C. (2017) 8 Cyber Security Best Practices For Your Small To Medium-Size Business (SMB).
[Online] Cox Blue. Available from: https://www.coxblue.com/8-cyber-security-best-practices-
for-your-small-to-medium-size-business-smb/ [Accessed on: 10/09/17]
Singer, P.W., and Friedman, A. (2014) Cybersecurity: What Everyone Needs to Know. Oxford:
Oxford University Press.
Tech Target. (2017) Cybersecurity. [Online] Tech Target. Available from:
http://whatis.techtarget.com/definition/cybersecurity [Accessed on: 10/09/17]

CORPROATE GOVERNANCE 15
Willson, D., and Dalziel, H. (2015) Cyber Security Awareness for Corporate Directors and Board
Members. Waltham, MA: Elsevier.
World Economic Forum. (2017) Advancing Cyber Resilience Principles and Tools for Boards.
[Online] World Economic Forum. Available from:
http://www3.weforum.org/docs/IP/2017/Adv_Cyber_Resilience_Principles-Tools.pdf [Accessed
on: 10/09/17]