CYBER SECURITY

What is cyber security?

Cyber security comprises technologies, processes and controls that are designed to protect systems, networks and data from cyber attacks. Effective cyber security reduces the risk of cyber attacks, and protects organisations and individuals from the unauthorised exploitation of systems, networks and technologies.

What are the consequences of a cyber attack?

Cyber attacks can disrupt and cause considerable financial and reputational damage to even the most resilient organisation. If you suffer a cyber attack, you stand to lose assets, reputation and business, and potentially face regulatory fines and litigation – as well as the costs of remediation.

The UK government's Cyber Security Breaches Survey 2017 found that the average cost of a cyber security breach for a large business is £19,600 and for a small to medium-sized business is £1,570.

Start your journey to being cyber secure today

IT Governance offer a range of products and services that can help you to protect your business from the threat of a cyber attack

.

cybersecurity

Cybersecurity is the protection of internet-connected systems, including hardware, software and data, from cyberattacks.

In a computing context, security comprises cybersecurity and physical security -- both are used by enterprises to protect against unauthorized access to data centers and other computerized systems. Information security, which is designed to maintain the confidentiality, integrity and availability of data, is a subset of cybersecurity.

Elements of cybersecurity

Ensuring cybersecurity requires the coordination of efforts throughout an information system, which includes:

Application security

Information security

Network security

Disaster recovery/business continuity planning

Operational security

End-user education

One of the most problematic elements of cybersecurity is the constantly evolving nature of security risks. The traditional approach has been to focus resources on crucial system components and protect against the biggest known threats, which meant leaving components undefended and not protecting systems against less dangerous risks.

To deal with the current environment, advisory organizations are promoting a more proactive and adaptive approach. The National Institute of Standards and Technology (NIST), for example, recently issued updated guidelines in its risk assessment framework that recommend a shift toward continuous monitoring and real-time assessments.

Version 1.1 of the Framework for Improving Critical Infrastructure was released in April 2018. The voluntary cybersecurity framework, developed for use in the banking, communications, defense and energy industries, can be adopted by all sectors, including federal and state governments. President Donald Trump issued an executive order mandating that federal agencies adopt the NIST Cybersecurity Framework (NIST CSF) in May 2017.

As a result of security risks, investments in cybersecurity technologies and services are increasing. In 2017, Gartner predicted that worldwide spending on information security products and services would reach $83.4 billion -- a 7% increase from 2016 -- and that it would continue to grow to $93 billion by 2018.

Types of cybersecurity threats

The process of keeping up with new technologies, security trends and threat intelligence is a challenging task. However, it's necessary in order to protect information and other assets from cyberthreats, which take many forms.

Ransomware is a type of malware that involves an attacker locking the victim's computer system files -- typically through encryption -- and demanding a payment to decrypt and unlock them.

Malware is any file or program used to harm a computer user, such as worms, computer viruses, Trojan horses and spyware.

Social engineering is an attack that relies on human interaction to trick users into breaking security procedures in order to gain sensitive information that is typically protected.

Phishing is a form of fraud where fraudulent emails are sent that resemble emails from reputable sources; however, the intention of these emails is to steal sensitive data, such as credit card or login information.