Cyber Resilience at the Board Level: Afterpay Case Study Report

This report provides a comprehensive overview of cyber resilience, emphasizing its importance in modern business operations. It defines cyber resilience as the integration of business management and cyber security, highlighting the need for proactive strategies to mitigate cyber threats. The report uses Afterpay, a financial technology company, as a case study to illustrate the practical application of cyber resilience principles. It explores the significance of cyber security at the board level, emphasizing the need for board members to understand and actively participate in risk mitigation. The report details the cyber resilience process, including risk identification and assessment using ISMS, and recovery measurements through business continuity management (BCM). It integrates cyber security and resilience concepts, covering identification, prevention, detection, and response strategies. The report concludes with recommendations for initiating cyber resilience at the board level, including the design of a resilience board framework and regular meetings. The report emphasizes the importance of proactive measures, continuous monitoring, and the integration of cyber risk assessment with overall business risk management to ensure long-term success and protect brand value. This report is intended to help students understand the key concepts and practical applications of cyber resilience in a business context. It is a valuable resource for students studying business development, finance, and related fields, providing insights into real-world applications of cyber security and risk management principles.

Countering cyber risk

EXECUTIVE SUMMARY
Cyber resilience is an important aspect to control and regulate the security threats and risks in
technology and networking. The report has discussed the need of resilience in business activities
with the example of Afterpay touch group. The report has addressed various concepts and
methods of resilience principles which can effectively analyse the risks of cyber threats. It has
provided recommendations for the cyber resilience at board level within organisation.

TABLE OF CONTENTS
EXECUTIVE SUMMARY ............................................................................................................2
INTRODUCTION...........................................................................................................................1
Cyber security at board level ..........................................................................................................1
Cyber resilience process..................................................................................................................2
Integrating the concept of cyber security and cyber resilience .......................................................4
Recommendations for initiating cyber resilience at board-level.....................................................5
CONCLUSION ...............................................................................................................................6
REFERENCES................................................................................................................................8

INTRODUCTION
Cyber resilience is defined as the integration of continuous business management and
cyber security issues. With digital transformation of business activities it is essential for the
organisations to frame appropriate and effective strategies to deal with the threats of cyber
attacks. The lack of attention towards security and the concept of cyber resilience can cause
severe damage to the performance of business activities (Jin & et.al., 2017).
This report will explain the impact of cyber security and resilience at board level of
organisations. It will elaborate the concepts with case study of Afterpay touch group. Afterpay is
financial technological organisation which has its head quarter in Australia and is ranked among
top 200 companies of ASX. The organisation provide facility to retailers to make payment
afterwards. The report will describe the integration of cyber resilience and security concepts for
improving the performance and effectiveness of Afterpay. It will also provide recommendations
for the organisation to implement these concepts into practices at board level rather limiting it to
only information technology department.
Cyber security at board level
Digital payments are becoming the essential part of consumers in their routine life. In
order to sustain the long term Afterpay must ensure that the valuable and highly sensitive
information which is exchanged between company and its stakeholders is safe and secure. The
data must be protected from threats of cyber attacks like hacking, data breaching, unauthorised
access and service denial attacks (DiMase & et.al., 2015). If Afterpay is vulnerable to these risks
then it will not only cause losses to organisation but will create trust issues among its target
audience as well and consumers will not prefer Afterpay touch organisation over others.
However, the networking and cyber security cannot be accomplished by mere support of
information technology department. It also requires the security strategies at board level of
Afterpay. Being a financial technical organisation it becomes more challenging and essential for
the group to protect its business activities from threats. It is the responsibility of all board
members and leaders of Afterpay to mitigate risks of cyber security. For instance IT systems of
firm may have highly advanced encryption against threats but if board members do not pay
attention to the threats or warnings then surely organisation will suffer from networking attacks
(Gisladottir & et.al., 2017).
1

The board members of Afterpay must ensure that advanced and effective tools are used
within organisation to keep the information secure. Only authorised people can access the
information. Senior leaders of Afterpay have access to the most sensitive data thus they are prior
target for hackers. Hence, all board members must be given cyber security training sessions and
guidelines so that security is not compromised. The senior authorities of board must analyse high
level summary of each quarter which describes the latest version of cyber attacks, hacking
attempts and counter measures adopted by company to mitigate those attacks.
For smooth functioning the top management of Afterpay must frame strict cyber risk
policies and methods. The regular monitoring and implementation of these policies at every level
will avoid possibilities of threat vulnerabilities due to any board member (Bell, 2017). The
company can leverage automation in its defence for reducing excessive load on security
management team.
In order to enhance the cyber security at high level Afterpay touch group can replace
legacy and duplicative technologies with alternative platforms which natively work as a single
unit. For boosting the cyber security they must implement advance resources with efficient
knowledge of machine learning algorithm which can easily handle the advanced attacks such as
ransomware. Threat intelligence will guide Afterpay to prioritize the response of attacks. It will
help it to analyse the possible impact of cyber threats on the business operations and it can be
mitigated.
Cyber resilience process
Cyber security technologies provide various tools such as antivirus, encryption and
control mechanisms which minimize the risk and extent of cyber attacks. On the other hand
concept of resilience aims at providing protection against these attacks and ensures that even
after cyber attacks Afterpay can continue its business activities without getting much affected by
the severity of cyber threat and risks. For sustaining the secure business approaches and
management Afterpay group can use following two strategies:
Risk identification and assessment:
In the first stage of resilience process organisation must identify possible risks factors
(Cyber resilience, 2018). For instance the latest advance risk is cloning of plastic cards. Afterpay
must make its system effective enough to detect such fake payment cards and to become more
2

trustworthy among its customers. Organisation must assess the all such risks related to
networking and information system of Afterpay. For achieving this goal effectively ISMS
(Information security management system) is one of the best solution It will regulate continuous
penetration testing. With ISMS company can manage its security concerns with minimum cyber
risk. It is cost effective approach and provides confidentiality and integrity to the data (Christou,
2016).
Recovery measurements:
The second strategy involved in cyber resilience is to evaluate the response measures
which can help Afterpay touch group to minimise extent and impact of cyber attacks. The
resilience concepts thus aims at guiding organisation to survive in case of cyber attacks also and
to return to its routing operational activities without letting these attacks to affect. The
organisation can implement business continuity management (BCM) system. Thus, when cyber
threats attacks the organisation then also the critical business function can be sustained. It will
provide strategies for quick recovery from the impact of attacks.
With theses cyber resilience programs Afterpay will be able to reduce the financial losses due to
breach in cyber security. Data protection acts are mandatory for the organisations to avoid legal
complications as well as for building trustworthy brand. These regulations can be followed by
improving this incident based response management plan (Fisher, Norman & Klett, 2017). Apart
from providing cyber security the cyber resilience process also enhances effectiveness of internal
infrastructure. It increases the sense of attentiveness and ability to measure the possible risks
before their actual arrival. Afterpay can prepare itself with resilience to continue its business
activities with maximum protection and secured strategies.
These aspects are essential for the organisation to provide error free and secure services
to its customers. When these concepts are not implemented effectively in organisation then, it
may affect their brand value Resilience will give detailed description of effects on various stages
of networking threats such as post and prior effect of these risks on performance and response of
organisation during attack. This analysis helps company to achieve its long term goals with cost
effective methods as compare to cyber security tools which are more costly and less effective
with advanced version of cyber attacks.
There are five pillars that include identify, protect, detect, respond and recover.
3

 Identify- It must be identified that what data cyber threats can occur in business process.
With this polices can be developed. It will help in taking proper actions when threat
occurs.
 Protect- in this necessary step are taken in order to protect malicious attacks. Also, focus
is on protecting website from external threats and vulnerabilities.
 Detect- In these activities are developed and implement through which threats will be
protected (Kaplan & et.al., 2015). Also, monitoring is done to ensure that systems is
secured from any other attacks.
 Respond- It refers to the activities that are detected and measures are taken in order to
respond to that attack in effective manner.
 Recover – It is last stage in which data that is lost is recovered or retrieved. Moreover, in
this organisation restores process or methods quickly in case of any major attack occurs.
Integrating the concept of cyber security and cyber resilience
Afterpay requires effective strategies for cyber security which is far beyond only
antivirus or network protecting tools. The top leaders of the above quoted organisation can
proactively mitigate the risks by implementing cyber resilience in business practices. It will also
increase confidentiality in the matter of discussion and strategies. To overcome the risks such as
denial of services Afterpay can use a single or few DNS servers instead of using multiples of
them. These practices of cyber resilience helps organisation to identify and detect the
possibilities of technological failures. The identification will provide strategies and methods to
the company to minimize the extent of financial loss and loss of brand equity (5 Steps To
Integrating Business Continuity And Cyber Resilience, 2018). For building cyber resilience
Afterpay can following stages:
Identification: For making strategies to mitigate the cyber risks organisation first need to
identify the set of all possible threats which can cause harm to the operational activities and
brand value of enterprise. For instance the risk events such as denial of service attack (DOS),
trials of unauthorised access and data breach can cause severe impact on the performance. With
cyber resilience when these events are identified then the senior ranking employees can make
suitable strategies.
4

Prevention: Organisation must regularly conduct the board level meeting for auditing the status
of cyber security. This audit will update the authorities to the extent of possible threats and the
corresponding mitigation strategies of Afterpay. Every individual must have complete
knowledge of the tools, process and their roles in assuring the security at each level.
Detection: The aims of resilience can be achieved only with the help of suitable tools and
methods. The tools which are used for threat identification must be effective and cost supportive.
The technologies are keep changing so the company must employ tools which can be used for
long terms (Jin & et.al., 2017). For example in majority of threats machine or high level
algorithms can be significantly effective. Thus, their training sessions and implementation can
serve the purpose on various occasions.
Response: The another crucial element of the cyber resilience plan of Afterpay is the response
evaluation. Board level of the company must comprise members from cyber audit team which
can audit the different aspect of the cyber risks. In the events of networking attacks the company
must have action plan which describes its damage control moves and action plan. This response
plan must be notified to each one of the influenced group so that damage can be minimized and
recover at the earliest.
For achieving the long term success it is important to create specific principle set which can push
resilience in action. The business enterprise can also integrate these cyber risk assessment with
the business related risks. It will help the concern authority to establish priorities for the
management of emerging technical threats. Before implementation of any innovative plan, it
analyses the various possible risks in cyber security of Afterpay from the perspective of all of its
stakeholders.
Recommendations for initiating cyber resilience at board-level
The foremost step for implementing the resilience in business at the board level is to
design a resilience board framework. It will provide them guidelines to carry out effective risk
analysis. The meetings must be held regularly for keeping an updated record of the threats and
their solutions. Each member of the group must have awareness regarding its responsibility and
duties. The accountable officer plays important role in achieving the goals of resilience and
cyber security. For successfully conducting the business activities Afterpay must integrate the
5

resilience with the assessment of threats. The following principles of corporate governance can
help company to initiate the concept at every level of the enterprise.
 The various stakeholders of business such as investors, consumers and employees must
be collaborated for better execution of the resilience plans.
 Resilience planning must be regularly tested and evaluated so that necessary
improvements can be added (Bell, 2017). The improvements must focus on the latest
advancements in the digital technology and growing business of the company.
 The effectiveness of the resilience principles must be reviewed annually by the
accountable authority and senior leaders of the business. For instance the yearly audit of
the risk evaluation process can help information technology team to identify the systems
which requires the updates of antivirus or which are more vulnerable to the denial of
service attacks. Thus, before the actual attack or risks Afterpay can resolve the cause for
the issue.
 Before giving confirmation to any innovative technology into practice, the risk
assessment committee must actively discover the various aspects of risks (DiMase &
et.al., 2015). For example when supporting online payment the future may generate risks
like hacking the security codes, password streaming in illegal manner as well as the
stealing of personal records. Afterpay must have strong technical support team which can
manage such critical incidents.
 Cyber risks are evaluated at every stage of operational activities. Like during adaptation
of the new technical event there are higher security risks at the time of implementation.
Its maintenance and last stage of its life cycle can also invite vulnerabilities. Thus board
members of the enterprise must have effective planning to deal with the threats at every
stage. Otherwise, it may happen that after investing great amount in introducing new
technology company has to drop the idea due to severe risks in supply chain of the
proposed plan. It can lead to unnecessary time and resource consumption without giving
any fruitful output.
 The business institutes must make a balance between the risks of innovations and
strategic objectives of Afterpay. It is required for the concerned authorities that there
6

must be a balance between the risk assessment and the priorities of the business (Norman
& et.al., 2016).
Hence, it is required for the company to develop its cyber resilience capabilities in such a way
that it provides the best support to the long term objectives of the operational activities of
business. These programs must manage the risks effectively and at the earliest to optimize the
benefits of innovations.
CONCLUSION
From the report it can be concluded that with adaptation of the technical advancements it
is essential and challenging for the organisations to protect themselves from the threats of
networking. For sustaining the optimized benefits from technologies organisation must adopt
cyber resilience into its practices. The ignorance to these approaches can put the business at the
risk of hackers and just in few minutes the entire business can collapse.
The inability of the organisations to incorporate these cyber attacks also make it difficult
for the consumers to choose the organisation over other successful competitors. The report has
explained the requirement and impact of cyber security at the board-level. It has also described
the effect of cyber resilience on improving the performance of enterprises. It can also be
concluded from the report that cyber resilience is essential for maintaining the cyber security and
to avoid the networking related risks.
7

REFERENCES
Bell, S., 2017. 'Cybersecurity is not just a'big business' issue', Governance Directions. vol. 69,
no. 9, pp.536.
Christou, G., 2016. Cybersecurity in the European Union: Resilience and Adaptability in
Governance Policy. Springer, Germany.
DiMase, D., Collier, Z.A., & et.al., 2015. 'Systems engineering framework for cyber physical
security and resilience', Environment Systems and Decisions, vol. 35, no. 2, pp.291-300.
Fisher, R., Norman, M. & Klett, M., 2017. 'Enhancing infrastructure resilience through business
continuity planning', Journal of business continuity & emergency planning. vol. 11, no. 2,
pp.163-173.
Gisladottir, V., Ganin, A.A., & et.al., 2017. 'Resilience of cyber systems with over‐and
Underregulation', Risk Analysis. vol. 37, no. 9, pp.1644-1651.
Jin, D., Li, Z., & et.al., 2017. 'Toward a cyber resilient and secure microgrid using software-
defined networking', IEEE Transactions on Smart Grid, vol. 8, no. 5, pp.2494-2504.
Kaplan, J.M., Bailey, T., & et.al., 2015. Beyond Cybersecurity: Protecting Your Digital Business.
John Wiley & Sons, New Jersey.
Margaret, R 2018, 'Cyber resilience', viewed 6 September 2018,
<https://whatis.techtarget.com/definition/cyber-resilience>.
Michael, D 2018, '5 Steps To Integrating Business Continuity And Cyber Resilience', viewed 6
September 2018, <https://www.continuitysa.com/5-steps-to-integrating-business-
continuity-and-cyber-resilience/>.
Norman, S., Chase, J., & et.al., 2016. 'A condensed approach to the cyber resilient design
space', Insight. vol. 19, no. 2, pp.43-46.
8