The challenges on the cyber threat landscape are vast and have demonstrated the capacity to create significant disruptions to businesses, economies and individuals. Singular incidents, which may seem minor or insignificant at the moment, regularly wreak havoc on digital ecosystems. Because of the immense challenges posed by threat actors and various non-malicious activities, it is vitally important for organizations to engage in cyber risk management around business-critical software, services and internal practices. There is no singular framework that works for every business, but there are valuable measures that can help bring lasting resilience.

Cyber threats are top of mind for many individuals, businesses and public entities. The 2024 Global Risks Report from the World Economic Forum identified “cyber insecurity” as the fourth most severe short-term risk and eighth in long-term risk, as just one indication of its worrisome global presence.1 The repercussions can be devastating if cyber defenses fail to protect sensitive data, maintain operational uptime and limit financial or reputational damage caused by cyber incidents. An investigation of the current landscape provides a valuable starting point for understanding both the gravity of trials facing today’s business climate and how to navigate threats to build resilience and improve business continuity.

Businesses must be forward-looking and prepare for unknown cyber threats, which can be daunting and feel impossible. Having a robust and well-developed cyber program is a must in today’s technological era. But what does this entail?

A resilient and prepared organization is one built with a culture that prioritizes managing cyber risk. When constructing this culture, it is incumbent on executives and business leaders to promote and demonstrate cyber awareness; non-management team members should understand the basic components of cyber hygiene as well as their significant role in achieving organizational cyber maturity.

The two overarching goals of cyber maturity are enhanced visibility and sufficient preparation: Do you have visibility into all the devices and user activity on your network so you can monitor for both approved and suspicious behavior? Do you have an appropriate and effective incident response plan when something problematic is inevitably detected? While no infallible program exists to prevent all malicious threats or avoid costly insider breaches, visibility and preparation will go a long way to building lasting organizational resilience.

For those looking for guidance, proactive risk and vulnerability assessments offer valuable starting points. The first order of gaining optimal network visibility requires awareness of what devices, users and other technologies are connected to that network. Vulnerability scans, penetration tests, web application assessments and other examinations of your organization’s digital blueprint can provide a baseline for network activity while also identifying potential blind spots in need of patching or remediation. Addressing gaps in your business processes, policies or personnel regarding cyber readiness can help you better protect sensitive information, business-critical data and operational continuity.

These thorough assessments should extend to third-party service or software providers that in any way handle, store or maintain access to sensitive, business-critical data. Third parties are vital resources, necessary to help organizations develop and enhance market opportunities. In most cases, these relationships are mutually beneficial; however, there are associated risks. According to data published by the U.S. Securities and Exchange Commission (SEC) from a Security Scorecard study, 98% of companies are associated with a third party that has experienced a breach.5 While this does not necessitate any significant downtime or data loss, there should be a healthy concern for the safety of working with distant third parties.

One reason for third-party risk is the lack of control of data flow. Third parties, in their scope of service provision, manage your data and accessibility to their systems. If a vendor fails to update their own software—or that of a third party with whom they contract— and succumbs to a security issue, or experiences a breach themselves, the repercussions will inevitably trickle down to the contractor and, in some instances, into the larger supply chain.

While these risks cannot be erased entirely, there are mitigation strategies contracting organizations can employ to limit potential negative consequences associated with third parties. Conducting a thorough risk assessment that includes vetting the relevant internal policies, historical efficacy and adherence to industry or regulatory compliance standards of any vendor that will have access to sensitive data will likely reveal gaps and vulnerabilities in their operations, which can then be addressed. This might mean working to ensure all data flowing to and from your business is encrypted or that additional resources need to be developed or contracted to enhance overall security posture, including 24/7 Security Operations Center (SOC) monitoring, the implementation of policies requiring strong passwords and MFA (multi-factor authentication), incident response planning, and general vulnerability management via risk assessments.

Furthermore, enhancing overall collaboration and communication with any third-party vendor can be beneficial. There is value in maintaining your agency when contracting for software or complementary services.

A recent report published6 by global business consulting firm Protiviti further highlights both the perception and gravity of the challenges facing organizations regarding third-party vendors. In their “Executive Perspectives on Top Risks for 2024 and a Decade Later,” third-party risks are the fourth greatest concern this year and sixth projected for 2034. Cyber threats, which are inextricably linked, rank third this year and first for 2034.

Actively maintaining a focus on cyber resilience

Visibility into your entire digital environment is necessary but requires real-time response capabilities to be most effective. If you see something suspicious, it is imperative to interrupt and remediate it before something damaging occurs, like a threat actor deploying ransomware in your system or the exfiltration of massive amounts of sensitive data. Active monitoring, whether conducted in-house or outsourced through a third party, can help businesses detect anomalies, unauthorized access attempts and other malicious network activities. Visibility into such events, as well as their remediation if detected early enough, can be established down to the individual endpoint level, which is necessary for individual business and supply chain security.

Maintaining such capabilities 24/7 is paramount because threat actors do not operate on a set schedule and, with the enhancements of artificial intelligence (AI), businesses cannot afford to have gaps of time when their digital environment is unmonitored. This monitoring is also a function of daily operations for all employees. Regular security awareness and phishing and social engineering training for team members and contractors who ever have access to the larger network in any capacity is a valuable component of active cyber resilience.

Preparation for the inevitability of a cyber incident

Without regard to the quality and specifics of your cybersecurity program, no prescription will keep your organization 100% protected against all potential threats. It is incumbent on organizational leaders to have a well-developed and tested Incident Response and Recovery (IR) plan in place if something were to threaten business continuity or data loss.

Whether it is your business or that of a client, IR planning should encompass several key areas with the principal goals of reducing downtime, limiting data loss, maintaining organizational reputation and protecting revenue. First, the team responsible for coordinating the response to an active incident must have the capacity to isolate impacted systems. As soon as malicious activity is detected, affected systems should be disconnected from the internet and the rest of the network to limit spread and preserve evidence for any subsequent investigation. In coordination with isolating systems, it is critical to immediately change all passwords for network directories and any remote access solution. Failure to do so could allow a threat actor to return and further disrupt the environment.

In a significant number of attacks, a vulnerable remote access solution is leveraged. It is critical that you do not enable public internet access via remote desktop protocol (RDP) on any server or allow any unpatched virtual private networks (VPNs) back online. All software should be fully patched and updated, MFA enabled and credentials reset before bringing them or the network back online.

An additional essential step in Incident Response planning is to maintain contact with your cyber insurance provider and any remediation team throughout the incident response and recovery process. You shouldn’t feel like you have to resolve a cybersecurity incident on your own. Beyond that, there are various reporting requirements by which many businesses must abide regarding how and when to share information about a ransom payment, ransomware attack or loss of legally protected data.

When developing an Incident Response plan, there are several components to consider as soon as an incident is detected, including the personal response responsibilities of each organizational leader, whom to contact for assistance and how to manage backup systems so they are part of an unaffected network. Engaging in tabletop exercises as part of ongoing development and practice of the Incident Response process can help significantly improve how executive, technical and functional teams act when IR plan implementation is required.

All these preparation components are elements of a larger Incident Response program that, to be optimally effective, must be in place before anything significant or problematic were to occur.

Preparation is Key

The rapidly evolving cyber threat landscape necessitates a comprehensive approach to cyber risk management and resilience building. The myriad challenges underscore the importance of developing robust cybersecurity frameworks tailored to each organization’s unique needs. Fostering a culture of cyber awareness, ensuring visibility into all network activities and maintaining effective incident response plans are critical components of cyber resilience. Ultimately, while no system can guarantee complete immunity from cyber threats, a well-prepared organization can significantly mitigate risks and swiftly recover from incidents, thereby safeguarding its operations, reputation and bottom line.