Embedding cybersecurity more effectively into business strategy

Integrating cybersecurity more effectively into business

The development of our digital society forces us to better address cybersecurity challenges. “Data is now the key asset of every company,” explains Cédric Mauny, Senior Manager of the Cybersecurity department at Proximus NXT. “It is essential to protect it more effectively. Regulations are increasingly encouraging us to do so, which is a positive step, in order to protect society from the risks and abuses associated with the improper or malicious use of data.”

In a world where everything is interconnected, companies must address system and data security issues from the very beginning of every project. As Cédric Mauny explains, given the risks involved, these aspects must be better integrated into every stage of the development of a company’s business activities.

An increasingly interconnected world

This is more relevant than ever today. Take, for example, how a modern car integrates a wide range of interfaces. The radio, GPS, battery, and many other components are all interconnected within a single platform: your vehicle. Beyond the automotive sector, we could also mention smart cities, increasingly connected electricity meters, or the latest technologies used in advanced medical applications.

“All these elements are becoming increasingly interdependent. However, the more interfaces we add, the more opportunities we create for malicious actors to identify entry points and exploit potential vulnerabilities to compromise systems. The interconnection of systems also increases the individual value of data, as information can be combined and analysed for profiling purposes, which further encourages attackers to organise themselves,” continues the Proximus NXT information security expert.

Considering the way technology is becoming embedded in our daily lives, it is not an exaggeration to say that, in many situations, our lives depend on the level of security provided by these systems.

Integrating cybersecurity into business priorities

It is now essential that cybersecurity issues are discussed at the executive committee level of every organisation. Cyber incidents — particularly cybercrime, extortion and data breaches (40%) — are now considered the second-largest risk by Boards of Directors, just behind business interruptions, including supply chain disruptions (42%), and far ahead of natural disasters, according to the Allianz Risk Barometer 2018 study.

“A crisis can indeed have significant consequences on business operations. It can impact a company’s finances, disrupt operations, damage its brand reputation and undermine user trust,” continues the expert. “To address these risks, companies must prepare for every possible scenario by establishing response plans based on identified risks. This helps develop the right reflexes, define the procedures to activate during a crisis and ensure business continuity.”

From companies offering online transactional services, such as banks or e-commerce platforms, to legal or medical firms, software development companies and even web design agencies, every organisation must better integrate these challenges.

“The way business activities are organised and the procedures implemented are now just as important as the design of a website or the deployment of IT systems. Security must be considered at every level,” explains Cédric Mauny. “This does not only concern large organisations. Every company has assets to protect, whether it is the manufacturing secrets of an innovative SME or the personal data of patients in a private clinic. Everything must be protected ‘by design’ in order to build the trust required to develop business activities and mitigate potential risks.”

This is even more critical for operators of essential services — such as energy, transport, banking, financial market infrastructures, healthcare, drinking water supply and distribution — as well as digital service providers with the upcoming transposition of the NIS Directive.

Ultimately, even if you believe your own organisation has nothing worth protecting, it is the protection of your customers’ data and services that should guide your approach.

Developing organisation-specific cybersecurity strategies

In this context, it is essential to be supported by specialists in cyber risk management and professionals capable of helping organisations reduce these risks.

“Every company is different, depending on its business activity, the market in which it operates, and even its internal culture — particularly its risk appetite,” explains Cédric Mauny. “The context plays a key role when assessing cybersecurity challenges. As a result, the solutions to be implemented, whether internally or through outsourcing cybersecurity management, will directly depend on a clear understanding of existing risks and opportunities.”

“Many organisations choose to outsource these aspects to Proximus NXT in order to benefit from optimal protection and focus on creating value within their own industry.”

“There is no one-size-fits-all approach. However, organisations must be able to address cybersecurity as a whole by protecting systems, detecting threats, responding effectively and repairing damage when necessary,” adds the cybersecurity expert.

“Before any attack occurs, processes must be established to detect issues and better understand them. Every organisation must give itself the means to improve its protection and resilience.”