Cyber Security: Why Senior Leaders Need to Take Charge in 2024

Only 21% of organisations are very confident in their organisation’s current approach to cyber security, according to data gathered during a recent ICAS (Institute of Chartered Accountants of Scotland) webinar co-hosted by Lugo and Mitigo during CyberScotland Week 2024. The webinar (which you can view here: https://tinyurl.com/LugoICAS) which attracted around 100 attendees, also revealed that over half of respondents felt only somewhat prepared to handle the latest cyber threats. These findings highlight the critical need for effective leadership in building robust cyber defences within organisations.

Leadership’s Unwavering Responsibility: A Legal Requirement

The central theme of the webinar emphasised the critical role of senior leadership in establishing and upholding cyber security within organisations. While the poll conducted during the webinar revealed diverse perspectives on who holds responsibility (with 19% indicating the senior leadership team, followed by other options like third-party providers and internal IT teams), it’s crucial to remember that directors ultimately hold legal accountability for managing cyber security risks effectively, as detailed in the UK Companies Act 2006 (specifically, Section 172). This legal requirement underscores the unwavering responsibility of senior leadership to prioritise cyber security.

Here we explore the key takeaways and incorporate valuable insights from quantitative data gleaned from this webinar on cyber security awareness and preparedness. Graphical insights are included below. 

Remote Work Rush: A Security Gap Waiting to be Exploited

The findings suggest that the business was not widely prepared for the shift to remote work that the COVID-19 pandemic necessitated, with 40% of respondents indicating that their organisation was not comfortable at all with remote working before the COVID-19 pandemic. This suggests that a significant portion of organisations lacked the necessary infrastructure or culture to support remote work effectively.

The COVID-19 pandemic has had a significant impact on the way that businesses in Scotland use technology. The shift to remote work and the need to adapt to new ways of working have likely driven the increased reliance on IT. The vast majority of respondents (over 97%) indicated that their organisation’s dependence on IT has increased since the pandemic, having become more reliant on IT in order to function effectively in the new remote work environment.

The pandemic forced a rapid shift to remote work, and many businesses simply weren’t ready. This lack of preparation likely led to shortcuts and insecure work arrangements. While the priority was keeping the business running, security may have been overlooked. This creates a vulnerability that cyber criminals can exploit. Now, as businesses settle into a hybrid work model, it’s crucial to take a step back and reassess your security posture. This is where Zero Trust comes in.

While some organisations are leading the way with cyber security by implementing a Zero Trust approach, many others seem unsure. Zero Trust means never automatically trusting anyone or any device trying to access your network, constantly checking their identity and permissions. Half of those surveyed weren’t sure if their business has adopted a Zero Trust approach to cyber security, and a quarter said they definitely haven’t. This suggests there’s a need for more cyber education around this change in mindset to a Zero Trust approach to data security.

Shared Awareness, Engaged Workforce

While leadership holds ultimate accountability, the data also highlights the importance of fostering a culture of shared awareness within the organisation. Nearly a third of respondents indicated their organisation relies on a third-party provider for cyber security, highlighting the value of external expertise. However, over a quarter rely on their internal IT team, and almost a fifth involve any employee with access to systems. This underscores the need for clear communication and ongoing education to equip everyone with the knowledge and vigilance to identify and report potential threats.

Building Resilience: A Leadership-Driven Approach

The presentation emphasised the importance of building organisational resilience against cyber threats, supported by over 60% of respondents indicating they are only somewhat prepared to handle the latest threats. This leadership-driven approach to building resilience involves three key areas:

1. Establishing a clear cyber security strategy: Aligning cyber security measures with organisational goals and risk tolerance is crucial. Leadership plays a vital role in defining this strategy and ensuring its implementation.
2. Implementing robust security measures: This encompasses technical controls (such as those implemented through Cyber Essentials certification), user education, and incident response plans tailored to the organisation’s specific needs. (See CyberScotland’s Incident Response Resources). Leadership plays a key role in allocating resources and approving the implementation of these measures.
3. Continuous learning and adaptation: Regularly reviewing and updating security practices is essential to stay ahead of evolving threats. Nearly half of respondents indicated a need for further learning on various topics, including risk management, new threats, and multi-factor authentication. Leadership can facilitate this learning by providing access to training resources and encouraging knowledge sharing within the organisation. It is important to remember that everyone has a role to play in cyber security, and organisations should strive to create a culture where employees feel comfortable reporting suspicious activity.

Collaboration for a Secure Future

Lugo’s keynote presentation at the ICAS webinar concluded with a call for continuous learning and collaboration within businesses. Sharing knowledge, best practices, and resources, as facilitated by events like CyberScotland Week, can significantly enhance collective cyber resilience. By embracing their unwavering responsibility, fostering a culture of shared awareness, and implementing data-driven security measures, senior leadership teams can create a more secure and resilient digital environment for their organisations.

Are you ready to take your organisation’s cyber security to the next level?

If you feel like you need some support to improve your organisation’s cyber resilience, we’re here to help! Book a free initial call with one of our experienced team at a time to suit you: Book an Appointment