A Boardroom Case 

For cyber security as a managed service

Cyber attacks on British businesses are becoming more frequent and more sophisticated – that’s a dangerous combination. Although an attack remains statistically unlikely, the chances are increasing almost daily.

Despite these trends, too many firms are still adopting passive, reactive policies, only reacting after an attack has happened. The question to ask yourself and your board of directors is whether you would be happy to leave the contents of your home uninsured, and only react if you had a burglary.

Think of your cyber security strategy as an insurance policy. While the best tools used to be affordable only to large enterprises, they are now much more accessible to SMEs. Given this, the challenge becomes how to bring it onto your management team’s agenda.

IT needs to be an innovator

As a highly digital economy, it is vital to be at the top of your game in the UK market. Whether your customers are B2B or B2C, evolving customer demands, operational efficiency, and the need to differentiate your products or services means IT needs to be at the centre of everything you do.

To do so, the limited IT resources you have cannot be consumed by tactical activities such as cyber security defences. Bailing water out of a leaking boat is a guaranteed way to ensure you never have the time or focus to drive new digital products or experiences for your customers.

By outsourcing “keeping the lights on” IT tasks such as cyber security, internal IT teams can be put to much more strategic use to innovate, create and develop. In the digital age, the reality is that every business initiative is an IT initiative – or at the very least needs involvement from IT.

Communicate the cost of an incident

Although the most common link is with paying a ransom demand, there are many ancillary costs associated to a cyber security incident – so much so that the response to the incident often proves much more expensive than preventing them in the first place.

And that assessment does not factor in the great intangible of reputational damage – the loss of public trust. In short, if your customers lose trust in you, they will leave.

Not only that, but it is estimated that only 35% of SMBs could remain profitable for more than three months without access to vital data.

To compound the issue, there is a recognised cyber security skills shortage in the UK. This makes it difficult to hire in specialist cyber security professionals, and as a result it can mean IT generalists without specific cyber skills trying to plug the gap.

Protecting the core of your business

More than 90% of successful hacks and data breaches start with phishing scams. By focusing on this threat and eliminating it, you can significantly reduce the cyber security risk factor.

By adopting cyber security as a managed service, you can focus on what matters to your without worrying about managing the burden of day-to-day IT infrastructure. With NetUtils managed services, you gain access to their highly trained, certified and experienced technical team who will manage, review and maintain your critical infrastructure so you don’t have to.

Managed cyber security versus in-house

Four ways managed cyber security services trump in-house recruitment:

  1. Remove the pain and cost of recruitment: The cyber security skills shortage in the UK makes it difficult and expensive to recruit in-house
  2. Short term-ism: The average tenure of senior security leaders is less than 3 years
  3. Fills knowledge gaps: Only 6% of companies have a CISO on the board of directors, with the result being a lack of focus on security strategy
  4. Lack of skills: The number of technologies needed in a comprehensive security strategy make it hard to acquire those skills in-house

Find out more

Article featured on the MYREDFORT community: https://www.myredfort.com/managed-security-services/the-boardroom-case-for-cyber-security-as-a-managed-service/

Cyber Security Check-In

How is 2022 going so far? 

From tighter regulations for public sector to ransomware and the continued rise of the remote workforce, the senior management team at NetUtils offer their observations on how businesses are adapting to the evolving working landscape.

The ‘great return to the office’ has not materialised as expected by most, with more organisations opting to have more staff working remotely as a permanent option.

David Bundock, Chief Operations Officer, NetUtils

The first of the studies that have looked at issues such as productivity and mental wellbeing are starting to emerge and, in many instances, home working seems to be on parity with office working and, in some cases, proving a benefit. However, organisations are now looking at the often-temporary measures rushed out to support home workers that are now becoming standard.

Where masses of laptops were hurriedly deployed, and cloud based filesharing systems were utilised to help teams collaborate – these devices and platforms need to be audited for security and compliance to standards such as GDPR. This will inevitably trigger more use of cyber security as a service – especially as the current shortage of skilled IT and Infosec staff grows.

Although Ransomware isn’t new, the last year has seen its meteoric rise in the public consciousness and indications show this year is, unfortunately, more of the same.
Malcolm Orekoya, Chief Technology Officer, NetUtils

However, the move by AXA, one of Europe’s largest insurers, to stop offering new insurance policies that cover ransom payments to criminals for French policy holders may be the start of a wider trend across the region during 2022.

The logic is that ransom payments encourage more ransomware attacks and drive up the cost of cyber security insurance policies. Although UK companies can still gain insurance policies  that will pay ransoms – assuming you can prove no liability, it’s likely that AXA’s position might spread.

The whole market for insuring against all forms of cyber-attack and outage is an interesting area and I suspect that this will gain a great deal more attention from enterprises.

Tighter regulatory oversight for the public sector.
Ashok Thomas, CEO, NetUtils

The NHS is already going through Data Security Privacy Toolkit (DSPT) processes and several recent tenders for large public sector organisations have made compliance to Cyber Essentials Plus a mandatory requirement for every supplier.

If the NHS is a template, then more public sector organisations will be required to adhere to CE+ within a few years. I’d expect these requirements to spread to anybody that supplies into the public sector.

The framework is not onerous, but it is audited which means that organisations need to do more than just a “check box” exercise so it’s wise to start looking at these optional processes now and before they become mandatory.

These are just some of the issues faced by organisations big and small, public or private sector. SMEs are often particularly vulnerable if they lack the skills and resources to adapt at the pace required.

Article featured on the MYREDFORT community: https://www.myredfort.com/managed-security-services/cyber-security-check-in/