WELCOME TO
LEO

We are amid a silent and anonymous war as cyberattacks become more frequent and damaging. To protect ourselves and our customers from the magnitude of cyber-related financial losses, we are compelled to rethink our risk strategies.

For any company, recognising and guarding against risks is all part of running a successful business. This is an imperative, especially in the era of 4IR (the Fourth Industrial Revolution) with the threat-landscape evolving at a blistering pace.

That’s clearly the case with one of the biggest and fastest-growing risks that businesses now face: cyber-related incidents. The WEF Global Risks Report 2019 highlights a significant increase this year in the risk of cyberattacks leading to theft of money, data, and disruption of operations.

Financial loss from cyber incidents is also on the rise. A global study by the Ponemon Institute and IBM Security found that the average total cost of such an event was $3.86 million in 2018, up 6.4 percent from the year before; organisations in the United States having the highest total average cost at $7.91 million.

A generation ago, data was contained in paper files and secured behind locked doors or in computer systems prior to our modern interconnected environment. Thus, the risk of hackers breaking into company records was not something many companies gave much thought to. Moreover, hackers had little interest in retrieving such content. Risk managers were more likely to worry about the physical hardware.

However, in our current digital age, most companies depend on enterprise-wide computer systems where all company information often lies behind multiple access points – including the cloud – accessible anytime, anywhere. The data these systems continually collect and store – including customer data – is the most critical asset to the organisation. As such, this asset has become a prime target for cyberattacks; and the reason why regulators have upped the ante on both the privacy safeguards companies are legislated to implement, and the penalties for failing to do so.

With the changing business, legal and regulatory environment, companies can no longer rely solely on traditional risk management.

To be a responsible risk manager in today’s world, a company must educate itself on cyber-related risks that continue to evolve; identify their own cyber-related exposures; and become familiar with solutions available to remedy these exposures.

In assessing cyber risk, a company must consider various factors, including:

• The types of private information in databases that could damage the business if stolen
• The value of all data assets
• The value of customer data, and the vulnerability to customers if that data is breached
• The length of time the company can withstand a business interruption from a cyberattack
• The financial impact of the company being shut down for a length of time. Can your existing risk management strategy address these considerations continuously?