Success stories

Our customers come in all shapes and sizes.

We work with organisations from all walks of life, with different ambitions and requirements. Explore how we’ve helped them reimagine everyday, and align technology with their culture and business goals.

Cybersecurity mesh: best practice for new ways of working

A cybersecurity mesh approach gives organisations the agility, flexibly and scalability required to protect data, systems and users in a distributed world.
View case study >

Passwordless Authentication: benefits, challenges and deployment options

Is it finally time to ditch the password once and for all? Find out the benefits, challenges and deployment options for passwordless authentication in our blog.
View case study >

How to get the most out of the Azure Cloud

The Azure Cloud can offer businesses of all sizes and industries functionality that can increase productivity and enable innovation whilst decreasing overall costs. Find out how you can get the most out of the Azure Cloud, read on >
View case study >

5 best practices for cloud security

What best practices will help you shore up your cloud security most effectively? In this post we explore 5 to protect your networks, data and people.
View case study >

What is zero trust security and how can it be implemented?

To stay safe in 2021, the entire approach to network security must be reconsidered. If you want to find out more about zero trust security and how it can be implemented, read this >
View case study >

Cost of a data breach to UK businesses

What is the cost of a data breach for UK businesses, and how can you calculate the cost for your business? Read this blog to find out.
View case study >

Cybersecurity mesh: best practice for new ways of working

Have you heard of cybersecurity mesh? Gartner recently ranked cybersecurity mesh as its top security trend for 2021/22. Highlighting this strategic approach as a key solution for digital business, Gartner say that cybersecurity mesh provides “the flexible, agile, scalable and composable” security options required when “digital assets — and individuals — are increasingly located outside of the traditional enterprise infrastructure.”

While the concept of cybersecurity mesh may be trending because of digital acceleration driven by the pandemic, it’s not new.

Fortinet has been advocating the approach for over a decade with its Fortinet Security Fabric. And at Cloud Business we have been involved in many on-going projects deploying cybersecurity mesh platforms: with customers often starting with just a few components to address a specific requirement or threat, then expanding the ‘mesh’ as they grow and innovate their security.

What is cybersecurity mesh?

There is some debate around what cybersecurity mesh is. Is it a solution, a security infrastructure, a concept or something else? Gartner describes cybersecurity mesh as “a composable and scalable approach to extending security controls.”

It’s an approach that enforces security policies across an enterprise, allows organisations to integrate all their security solutions, and share cybersecurity intelligence, automate and coordinate responses to threats between them. 

Cybersecurity mesh doesn’t focus on a single perimeter around the enterprise infrastructure. This approach is now redundant as more people connect to enterprise networks and systems from different locations and different devices. Instead, each individual access point has its own perimeter, which also communicates and integrates with all other security solutions in the mesh.

Why traditional security solutions and strategies don’t work

The traditional approach of a single perimeter assumes that everything –devices and people -operate within the corporate infrastructure and are safe. The assumption is that they are not only protected from threats by the perimeter security, but also that they are not a threat themselves.

However, we no longer work that way. People and endpoints are now outside, working remotely, in cloud and multi-cloud environments, using their own devices and connecting to the network, systems and resources via the internet.

As well as some assets being outside the enterprise infrastructure, hybrid working means that sometimes they are also inside accessing the same systems and resources. 

In response to this, many organisations are now implementing zero-trust strategies, where no one and nothing is trusted, and everything and everyone is verified. This is often the catalyst for exploring the bigger picture and taking a more holistic approach to cybersecurity. A cybersecurity mesh.

The benefits of cybersecurity mesh

A cybersecurity mesh approach simplifies security operations, increases the effectiveness of security defences, and makes your security posture stronger and more agile. Other benefits include:

  1. Gaining deep visibility across all network edges
  2. Increasing agility and resilience
  3. Sharing and leveraging intelligence from organisations’ own tools and their entire ecosystem
  4. Ensuring the best real-time defence against known and evolving threats
  5. Increasing organisations’ focus on high-value tasks 
  6. Closing interoperability gaps between various vendors’ solutions
  7. Reducing deployment times and security failures

Use cases for cybersecurity mesh

Here are just a few of the many use cases for a cybersecurity mesh approach:

Securing remote and hybrid workforce

With remote and hybrid work here to stay, at least for some organisations, a cybersecurity mesh approach secures digital assets, endpoints, and users wherever they are and strengthens the security posture.

Growing businesses

Putting in place a cybersecurity mesh approach enables an organisation to scale without compromising security. By centralising its security policy management, as the organisation grows and the IT infrastructure expands and evolves, new access points can be protected and new security solutions integrated in a modular way.

Protection from insider threats

30 percent of data breaches involve organisation insiders acting negligently or maliciously. Securing each access point, implementing zero-trust strategies and deploying behavioural security solutions to monitor for non-compliant, suspicious, or anomalous behaviour, proactively protects from these types of threats.

Securing hybrid and multi-cloud environments

Cybersecurity mesh resolves a common problem with managing hybrid and multi-cloud environments. Security across an extended environment is complex to manage and there are often inconsistencies in the way it is enforced. A cybersecurity mesh platform provides full visibility across the entire attack surface, and integrates different security solutions on-premise and in the cloud.

Drives productivity and cost efficiencies

A centralised, single pane of glass, approach can deliver significant cost benefits. An integrated cybersecurity mesh platform can reduce the headcount needed to cover your cybersecurity function and the associated costs. Less downtime also results in increased productivity across the entire organisation.

Why should you consider a cybersecurity mesh approach?

With so many benefits and use cases for adopting this approach, it’s clear why it’s Gartner’s top security trend in 2002 and into the future. 

So why should you consider this approach for your organisation? Here’s what we think:

IT systems are vulnerable. With a 600% increase in phishing attacks over the last few years, and ransomware attacks occur every 11 seconds, most IT systems are vulnerable. Zero-day attacks are also on the increase, doubling in 2021 from 2020. The cybersecurity mesh approach helps to reduce all these vulnerabilities significantly and protect from new attacks like zero-day.

Escalating costs. The cost of a cyberattack is significant, and no organisation is immune. An increasingly complex security infrastructure is also expensive, both to procure and deploy, but also to monitor and maintain. With many organisations embarking on further digital transformation projects, new security solutions need to be deployed or existing ones redesigned. All contributing to a higher spend. Siloed security solutions can also result in more downtime when incidents do occur, decreasing productivity and the costs associated with that. After the initial investment in implementing a cybersecurity mesh approach, organisations will quickly see ROI as other costs decrease.

Agility, flexibility and ability to scale. Implementing a cybersecurity mesh does not mean procuring an entire platform in one go. It also integrates existing solutions so you get more value, potentially extending the lifecycle of some security tools. The cybersecurity mesh grows with the organisation’s requires and infrastructure, components are added as and when needed, increasing agility and providing a flexible and scalable security environment.

Digital transformation. The recent acceleration in cloud migration has left many organisations having to retrofit security policies and solutions, and close security gaps. As organisations continue on their digital transformation journeys, cybersecurity mesh supports migration and flexes as new cloud environments are deployed.

Simplifies security operations. The changing digital landscape with assets sitting outside of the enterprise infrastructure as well as inside, creates complexity. A cybersecurity mesh strategy provides that holistic view which makes managing security operations easier and less complex.

Cybersecurity mesh best practice

If you are considering implementing a cybersecurity mesh strategy in your organisation, here are five best practices to ensure success:

1: Prioritise interoperability

To manage a complex distributed and evolving network, you need a unified cybersecurity mesh. This means identifying the right vendors that leverage application programming interfaces (APIs) and common standards to support interoperability. Look for vendors that also allow policy decisions to be made outside of their solution. This will ensure you can apply consistent security policies across the entire enterprise infrastructure and across digital assets on the outside.

2: Deploy common datasets and frameworks

To integrate all your security solutions and for them to communicate with each other, they need to access the same common datasets. This ensures the solutions protecting network edges, endpoints, and clouds, are using real-time global and community threat intelligence. Common datasets and frameworks support holistic analyses of the security and performance state, identifies emerging threats, and enables a unified response across the organisation.

3: Advanced threat detection

A cybersecurity mesh also needs to include security automation with the ability to create new protections when data analytics detect unknown threats. It should be linked to extended detection and response (XDR), security information and event management (SIEM), and security orchestration, automation, and response (SOAR) solutions for increasingly advanced network operations centre (NOC) and security operations centre (SOC) environments; but be able to function autonomously within simpler environments. 

4: Rapid threat response

Using machine learning (ML) and artificial intelligence (AI), the cybersecurity mesh platform must be able to rapidly launch a coordinated threat response across the entire ecosystem the moment a threat is detected. The ability to do this, disrupts the attack sequence before it can complete its objective, and is a clear driver for taking the cybersecurity mesh approach. 

5: Dynamic and scalable

The cybersecurity threat landscape is ever evolving, and so are the tools and solutions to detect, protect and respond to threats. For this reason, your cybersecurity mesh platform must be dynamic so you can scale and expand. Deep integration is needed between security and network components so, returning to the first point, you need to work with vendors that support interoperability.

The beauty of a cybersecurity mesh approach is that you don’t need to work with just one cybersecurity vendor. Or replace existing solutions, provided they can be integrated into the cybersecurity mesh platform. 

As stated at the top of this post, cybersecurity mesh is not a new concept. However, the acceleration in digital transformation in recent years has effectively served as a proof of concept, and the cybersecurity mesh approach has clearly demonstrated its up to the job.

Would you like to learn more? If you want to explore implementing a cybersecurity mesh strategy in more detail, please get in touch. Our security team can will walk you through the approach and answer any questions.

Passwordless Authentication: benefits, challenges and deployment options

Poor password hygiene remains a key security weakness for many businesses. All employees know that a password should be long, complex, unique and never shared with anyone. Although this is simple in theory, in practice it can be difficult to remember a new complex password for every application or system. For this reason, it is common for employees to re-use passwords, or opt for a simple, easy to remember password. This is worrying, as a single user with a simple password may be the cause of a major cyberattack.

The introduction of multi-factor authentication has greatly reduced this risk, however it has come at the cost of convenience for users. The adoption of passwordless authentication aims to increase security, whilst providing a better user experience. In this article we will discuss the benefits, challenges and use cases for passwordless authentication.

What is Passwordless Authentication?

Passwordless authentication is a method of multi-factor authentication that negates the need for passwords. This is achieved through systems that verify a user’s identity using something they are (such as biometrics), or something they have (such as a mobile device or security key). When the user requests access to an application or system, a new authentication request is generated. Therefore, the user does not need to enter a password, and no password is stored within the platform, therefore there is nothing for a cybercriminal to steal or phish.

3 benefits of passwordless authentication

1: Improved user experience

For employees, having to remember multiple long, complex passwords can be a frustrating experience. Similarly, a poorly implemented multi-factor authentication solution can feel like a waste of time, especially if it is required for all applications. With passwordless authentication, the user experience is greatly improved, with no need to remember passwords. If passwordless authentication is implemented in Azure Active Directory with Single Sign On enabled, employees can log into once to have access to all the applications and services they use on a daily basis.

2: Increased security

If a cybercriminal gains access to an employee’s password, they can use the compromised account to access company data or launch another attack. With this form of authentication, this is not possible as it is not possible for a cybercriminal to steal biometrics from an individual. Similarly, as there is no password, phishing attacks are no longer a viable method of account compromise. 

3: Save time and money

IT teams spend a significant amount of time resetting employees’ forgotten passwords. With passwordless authentication, it is not possible to forget a password, or need it reset. This allows IT teams to spend more time focusing on optimising current use of technology within a business and ensures that employees do not lose access to critical IT systems whilst working.

Challenges

Ultimately, businesses will benefit from implementing a passwordless authentication solution, however they may run into some challenges along the way. The main challenge of passwordless authentication is the deployment process, if a business does not have experience with the technology, or visibility of all the applications and services employees use, deployment can become difficult and complex. Fortunately, there are tools and support available to help you successfully deploy a passwordless authentication solution.

Deployment options

Windows Hello for Business

Windows Hello for Business is an option that utilises two-factor authentication with a PIN and biometric authentication. The biometric authentication works by using pre-existing hardware on an employee’s work device. This may include either a fingerprint scanner, or facial recognition using the in-built camera. This method is more secure and convenient than a traditional password as it uses multi-factor authentication, and the biometric authentication only requires the user to touch a sensor or look into their camera. However, this method will not work if the employee’s device does not have a fingerprint scanner or in-built camera.

Microsoft Authenticator App

The Microsoft Authenticator app is another method of passwordless authentication that uses either biometrics or a PIN, similar to Windows Hello for Business. This option requires users to have the Microsoft Authenticator app installed on in their Android or IOS device. When the user reaches the login screen and enters their username a push notification will be sent to their phone, opening the Microsoft Authenticator app. They then enter either a PIN or use their phone’s native biometric features. This method works particularly well for businesses that already use the app for multi-factor authentication.

FIDO2 Security Keys

FIDO2 security keys are physical devices that work similarly to a key for a car or house. The keys come in many form factors, including USB devices, an NFC chip or a Bluetooth device. With this option, an employee must connect the device and they will be automatically logged in. This method is typically used by businesses that are particularly security sensitive or have employees that would rather not use biometrics or their phone for authentication.

Passwordless authentication is becoming more commonplace in businesses looking to improve their security posture, whilst creating a better experience for their employees. If you have any questions about taking the next step to a passwordless future, please get in touch. 

How to get the most out of the Azure Cloud

The Azure Cloud offers businesses of all sizes and industries functionality that can increase productivity and enable innovation whilst decreasing overall costs. This may be through replacing existing physical infrastructure, or making use of next generation technologies such as AI and machine learning. 

However, migrating to the Azure Cloud does not guarantee cost savings as running workloads in the cloud without managing costs can result in unexpectedly high bills. Thankfully there are many tools within Azure to assist businesses to manage budgets effectively. In this article we discuss how businesses can get the most out of the Azure Cloud through effective cost management, next generation technologies, and by strengthening their security posture. 

Ready to start your Azure journey? Explore our Azure migration services here >

Take advantage of big data analytics

Technology-reliant businesses collect an exorbitant amount of data. This includes everything from data relating to customers and their buying habits to data captured from business processes. This data can be analysed to help businesses make better informed decisions to ensure long term sustainable growth. However, there are two key hurdles to overcome to truly drive value from captured data: storage and analytics.

To take advantage of big data analytics, first you must have an effective method of storing the necessary data. Azure has database options to suit all businesses and use cases. Some options for big data file storage include Azure Lake Store, and Azure Storage Blobs – the most flexible way to store blobs from numerous data sources These blobs can be any form of file including logs and database backups. Azure Data Lake Store is a hyperscale repository for big data analytic workloads which enables businesses to capture data of any size and type to store in a single location for analytics.

Once you have implemented a big data storage solution, they are able to use Azure to analyse the data to make informed decisions. Once again there are numerous big data analytics solutions available through Azure to meet different business needs. The three most common solutions include Azure Analysis Services, Data Lake Analytics, and Azure Synapse Analytics. All of these solutions are designed to quickly, and easily, scale regardless of how much data is collected and use next generation analytics to give powerful analytics that can enable data-driven decision making. 

Make use of Azure Cost Management

Regardless of what workload a business hosts in the Azure Cloud, it’s important to make the most of Azure Cost Management to get the best value for money. A simple way to do this is by using the cost analysis section of Azure Cost Management. This enables business leaders to view projections of future costs based on current usage. It’s also possible to enter a spending budget, and if usage looks likely to go over budget, take steps to reduce consumption.

You can also set alerts within the budgets section of the Cost Management tool for when a certain budget percentage is reached. When the alert is triggered, an email is sent to inform the business owner. This early notification makes it easier for businesses adjust their consumption to ensure they do exceed budget. 

Both suggestions will help you stay within spending limits whilst using the Azure Cloud. For cost optimisation, use the advisor recommendations section of the Cost Management Tool. This gives actionable recommendations of how to optimise costs to get the best value for Azure spend.

Enable SSO and MFA in Azure AD

Businesses that use Microsoft 365 are already making use of Azure Active Directory, Microsoft identity and access management platform but not all are getting the most out of the solution. Within Azure Active Directory it’s possible to enable Single Sign-On (SSO) which allows users to activate one set of login credentials for a multitude of Software-as-a-Service (SaaS) applications. Enabling SSO increases productivity as users do not need to enter multiple login credentials and it increases security, as users only need to remember one long, complex password, rather than many.

It’s also possible to enable multi-factor authentication (MFA) – an authentication process where a user must provide two or more forms of identification to login into their account. Azure AD Multi-Factor Authentication requires two or more of the following authentication methods: something you know (typically a password), something you have (typically a trusted phone or hardware key), and something you are (typically biometrics, such as a fingerprint or face scan). Enabling MFA greatly increases security and can stop 99.9% of account compromise attacks, as even if a cybercriminal knows a user’s login credentials, they can’t access their account.

Want to get the most out of the Azure Cloud?

These are just some of the many ways businesses can work more productively, save money and increase security through the Azure Cloud. If you have any questions about Azure please contact us. We’d be happy to help.

5 best practices for cloud security

The cloud is a shared responsibility platform. This means that although most cloud technology companies provide excellent cloud security tools, it’s down to you to ensure that what you move to the cloud is secure. 

Follow these 5 best practices to strengthen your cloud security: 

  1. Identity and access control 
  2. Security posture management 
  3. Secure apps and data
  4. Threat protection
  5. Network security 

Cloud security best practices 

1: Identity and access control 

Cloud security practice number one is to “assume breach”. This means behaving as if an attacker has breached the network perimeter and you need to do everything possible to protect your data and systems. 

Identity and access control is where you can prevent attackers already instead your network perimeter from accesses the most sensitive data. Deploy the following: 

Multifactor authentication – two or more of the following authentication methods 

  1. Something you know (typically a password)  
  2. Something you have (a trusted device that is not easily duplicated, like a phone)  
  3. Something you are (biometrics)  

Conditional access – set conditions that only allow sensitive resources to be accessed in certain way. For example, blocking or granting access depending on a specific location. 

Operate a zero trust model – verify everything that wants to authenticate or connect to your IT environment. More on the zero trust model here > 

2: Security posture management 

Get ahead of the curve by prioritising and actioning recommendations to improve your security posture. This helps to get you out of reactive mode where you’re constantly responding to threats. If your IT environment is in 365 and Azure, a free Secure Score Analysis will help you understand what actions to prioritise. 

3: Secure apps and data 

A layered, defense-in-depth strategy across identity, data, hosts, and networks protects your apps and data. Use encryption for data at rest and in transit, make sure your open dependencies don’t have vulnerabilities, and remember the cloud is a shared responsibility model (so you don’t have to do everything.) 

Here’s what you’re responsible for, what’s shared and what’s down to your cloud provider: 

4: Threat protection 

Ensure threat detection is enabled for virtual machines, databases, storage, and IoT. Use a cloud provider that integrates threat intelligence, providing the necessary context, relevance, and prioritisation for you to make faster, better, and more proactive decisions. Consider a cloud-native security information and event management (SIEM) to scale with your needs. 

5: Network security 

You still need to protect your network perimeter but remember a firewall is only as good as the people who deploy and manage it! If you don’t have time to do this work consider a Managed Service that will do it for you. Protect online assets and networks from malicious traffic by deploying Distributed Denial of Service (DDoS) Protection. Use virtual networking, subnet provisioning, and IP addressing to create a micro-segmented network that is harder to penetrate. 

If you need support strengthening your cloud security, get in touch for an informal chat about your IT environment. 

What is zero trust security and how can it be implemented?

In 2020, the global average cost of a data breach was $3.86 million (USD). On average it took businesses 207 days to identify the data breach, and 73 days to contain it. Regardless of the size or industry, all businesses are at risk of a data breach as they store valuable information, especially customer data. 

For this reason, businesses and security professionals alike are constantly searching for the best method of securing a network from all threats. 

Traditionally, most businesses use a castle-and-moat approach to security. This is where the focus of security is on the network perimeter and most of the security investment is in firewalls, proxy servers and preventing intrusion from outsiders. In theory this approach seems logical, however it has some key limitations. 

The castle-and-moat approach allows those within the network access to all data. This means that even if the moat is effective at keeping intruders out, it doesn’t stop users with compromised identities or insider threats. It’s also outdated as it was built for traditional networks and does not consider how networks have changed as businesses move to the cloud. 

Is your organisation at risk? Book a free cyber security health check with our expert team to find out >

Cyber security and hybrid work

With the workplace fundamentally changing, as hybrid work becomes the new norm, the traditional castle-and-moat approach is no longer viable. When all employees worked in an office space if a machine tried to access a network from outside the office it would raise a red flag. Now with employees working from home it is important to be able to accurately authorise and authenticate users, regardless of where they are physically located.

In order to overcome these limitations businesses must change the way they view network security; this is where the zero trust security model comes in.

What is the zero trust security model?

The zero trust security model assumes that there are malicious actors both inside and outside a network. Therefore, no users or machines are automatically trusted, and all requests must be authenticated and authorised. This verification is based on all data points, including user identity, device health, service or workload, classification and anomalies. Another key principle of the zero trust security model is least-privilege access. This states that users should only have access to the data they need to do their job, and nothing more. 

Why move to a zero trust security model?

The zero trust model greatly increases security and is a security model that considers how digital transformations have fundamentally changed businesses and their networks. This is particularly important as many organisations keep their data in the cloud, rather than on-premise. 

The modern network does not have clearly defined perimeters to protect, so the zero trust model moves the perimeter to each individual file. This model, especially the least-privilege access principle, significantly reduces the risk of an insider threat. As users can only access the data necessary to do their jobs it means they cannot access sensitive data that could be shared maliciously or accidentally. 

How to implement a zero trust security model in your business

There are multiple principles in the zero trust security model, and your business may already have implemented some of the necessary technology. However, transitioning to a comprehensive zero trust security model takes time and significant planning as it involves completely rethinking how a business views security. 

The key to successfully implementing zero trust architecture is to first take inventory of existing mechanisms and technology. It is important to consider how traffic flows through the network and what is currently controlling the flow. From there the business must implement the necessary technologies and policies in line with the zero trust principles. This includes identity access management, endpoint management, in-app permissions, data protection, and infrastructure and network security. Once your business has implemented all the necessary technology and policies it should be regularly reviewed and iterated upon to dynamically enforce policy changes.

The zero trust security model is a modern rethinking of what constitutes a comprehensive security solution for a business. It overcomes the limitations of the castle-and-moat approach and greatly reduces the risk of a data breach, even one due to an insider attack. However, the road to zero trust is not simple, and it takes time and expertise to ensure that all the potential benefits are realised. If your business is considering moving to a zero trust security model, and need some expert advice, please get in touch with our cyber security practice.

Cost of a data breach to UK businesses

Data protection is at the forefront of most CEOs minds this year as the inevitability of a data breach has become very much a reality for most organisations. While many public data breaches appear to be predominately in the US, we can’t afford to be complacent here in the UK.

The infamous data breach at TalkTalk in 2015 (actually the second that year, if not the third) certainly caused many people to wake up to this reality, not least after TalkTalk revealed that the cost of the October data breach amounts to £60 million. For a company with projected earnings before interest, tax and other items for the year ending in March of £255-£265m, and a dividend increase of 15%, this is not an insignificant amount.

Consider what it would mean to your business to have approximately a quarter of your income wiped out by a data breach. While we don’t know the breakdown of where the £60 million has been spent, we have a good idea of the costs a data breach incurs.

Stay safe by understanding current threats and your organisation’s risk level, explore our Cyber Security Posture Assessment here >

Calculating the cost of a data breach

The following factors can all contribute to the overall cost of a data breach. Although the average total cost of a data breach has risen year on year, £2.37 million based on the Ponemon Institute’s most recent benchmarking report, 2015 Cost of Data Breach Study: United Kingdom, where this money is spent as a percentage of the overall total has remained fairly stable.

  • Lost Customer Business: 43%* TalkTalk estimated they lost 101,000 customers following the October hack, but other estimates put this figure closer to 250,000.
  • Investigation and forensics: 16%*
  • Customer acquisition cost: 9%*
  • Inbound contact costs: 8%*
  • Outbound contact costs: 7%*
  • Audit and consulting services: 5%*
  • Public relations and communications costs: 3%*
  • Legal services – defence: 3%*
  • Legal services – compliance: 3%*
  • Free or discounted services: 2%*
  • Credit monitoring services: 1%*

Actual figures will naturally vary depending on the sector an organisation operates in, and the nature of the data breach. For example, ‘lost customer business’ will not be such a significant cost if the data breach only impacts on employee records. However, when looking at these figures CEOs should be aware that they may have higher risks and costs because of the sector they operate in. The table below shows the per capita cost by industry of those benchmarked organisations:

How to reduce the cost of data breaches

It’s not all doom and gloom. While another study by PwC – 2015 Information Security Breaches Survey – commissioned by HM Government, found that 9 out of 10 businesses in their survey had suffered some form of data breach; there are ways to reduce the cost to businesses. The Ponemon Institute study identified the following as factors that can reduce cost of a data breach:

  • Extensive use of encryption: up-to-date data protection methods protect both from malicious attacks and human error,
  • Incident response team: clear systems, procedures and key staff to deal with any data breach ensures that no time is lost addressing the breach and militating against it,
  • BCM involvement: awareness, training and planning for getting business critical systems back up and running in the event of an incident can reduce the costs associated with loss of business significantly,
  • Board-level involvement: sponsorship from the Board will ensure that cyber security and data protection procedures are embedded in the organisation,
  • Employee training: clear guidance and training on how to deal with a data breach, and how to recognise one (as well as prevention training), will result in a swifter and smoother response,
  • CISO appointed: fortunately for any Chief Information Security Officer reading this, your role is an important factor in preventing and reducing the risk and cost of data breaches,
  • Insurance protection: Data breach insurance naturally reduces the overall costs for the organisation, but may also be instrumental in putting better data breach planning in place so that incidents are managed effectively.

So although in all probability most businesses will experience a data security breach at some point, the risk can be managed and therefore the impact on your organisation reduced.

* Percentage of total cost for 2015, 2015 Cost of Data Breach Study: United Kingdom

Cloud Business Logo - white
Microsoft Gold Partner Logo - Cloud Business
Cloud Business Limited
5 Elmwood
Chineham Business Park
Basingstoke
RG24 8WG
Microsoft Gold Partner Logo - Cloud Business

2023 © Cloud Business Limited
Registered Company in England and Wales 06798438