In today’s fast-paced world, the security threats facing large global enterprises are increasingly complex and ever-changing. As such, global enterprises with thousands of employees need to be stringent with their policies to protect their business and customers.
In 2019, the UK’s Department for Digital, Culture, Media and Sport released statistics showing that almost half of UK businesses suffered a cybersecurity or breach attack. The threat here has been heightened in 2020, as many companies have been forced out of the office and into remote working cultures as a result of the Coronavirus pandemic.
This coupled with a more intense focus from firms to serve customers digitally, has pushed security and IT department teams to act quickly, ensuring they restructure digital processes and business operations to protect customers and their ability to trade online.
As a result, now, more than ever, multinational companies are rigorously assessing the risk that any third-party provider poses to the data and information they share and use.
To get ahead and open the door to global enterprises, businesses, startups and challenger brands must consider how their company squares up when it comes to the policies and capabilities of their security and quality control.
Finding what’s right for you
The first port of call for any business looking to revamp security processes, or to kick off good practices lies in selecting a known security framework. From there, ensuring that you are stress-testing your security processes, and proving capability through certification helps to reassure customers online.
Some of the most well-followed frameworks include MITRE ATT&CK, NIST Cybersecurity framework and ISA/IEC 62443. Companies that choose to follow these frameworks need to confirm that they are compliant with each framework, but despite this, there is no external audit after implementation.
This can be viewed in both a good and bad light as whilst compliance to these frameworks adds a layer of trustworthiness, the lack of external auditing and certification means additional questions could be raised—for example, by customers looking for further proof that the framework is actually in place.
That is why companies of all sizes could and should penetration test their services and processes. This process involves an external firm intentionally hacking into a businesses digital systems to identify security weaknesses that hackers could exploit.
There are some different flavors here; companies can either opt to do this on a regular basis or continuously. Carrying out continuous hacks is called responsible disclosure. It is looked upon favorably as it showcases ongoing and consistent commitment to the protection of assets.
Beyond stress-testing existing security, one of the most steadfast ways to showcase the maturity of a company’s security policies and framework is through applying for, and gaining, certification.
While time-consuming and rigorous, applying for certification is not as expensive or complicated as some might think. And, certificates are not just for more established companies. In fact, younger startups should seriously consider applying too. Not only does accreditation allow a company to embed security into its DNA and culture from the early stages, but it will encourage best practice and excellent standards going forward.
And, whilst certifications such as ISO 27001 have been around for a while, the prestige of these certifications continues to grow.
But, before applying it is crucial businesses look over the many certifications there are to select the one that’s best suited to the company, and most importantly, its customers.
Some of the most respected certifications include SOC 2, ISO 27001 and the Cloud Security Alliance STAR program. But, each has slightly different nuances, so it is critical businesses do their research. For example, SOC 2 is more focused on the US market, while ISO 27001 is more focused on the global market.
Implementing stringent framework
As soon as a certification has been decided, it’s time for organizations to sharpen up their framework in-house.
This starts with reviewing and renewing current security policies.
Buy-in from the top is essential here and comes as one of the requirements when applying. This is because whilst IT and security teams lead the certification process, all will undoubtedly fail without the support of top management. This is partly because if management doesn’t show commitment (to any change), no one else in an organization will. And, also because the breath of certifications can vary vastly to cover legal, HR and organizational issues affecting plans and policies across the entire business.
As soon as everyone has bought-in and frameworks across the board have been finalized, a rigorous audit will take place assessing policies and plans. Here an independent body will examine if they meet the required standards for international best practice. The panel will then make a decision about the certification and if the criteria has been completed for it to be awarded.
Inspire customer and investor confidence
While the application for security certifications is not an easy (or quick) process, the result is worthwhile. Following a security framework, and stress-testing your organization’s ability to protect customer data is paramount. But, going one step further to show customers that you are certified to act responsibly and protect their data online will serve as a valuable indicator that your business can be trusted.
Not only can specific certifications showcase that a business is recognized for international best practice standards – providing a reputable Trustmark. But they also highlight a company’s commitment to robust compliance and ongoing improvements.
As such, this stamp of excellence is likely to provide peace of mind to customers and investors alike demonstrating a capability to drive business value whilst reducing risk through mature framework and policies.
Marcus Södervall, Head of Security, Stravito
