“It’s not if, but when”, a phrase almost guaranteed to creep into any event with information security on the menu. Yet beyond the roundtables and fora increasingly devoted to cybersecurity and data privacy, this phrase took on a very real meaning as households in the SAR awoke on October 25th to the possibility that their personal information had been leaked along with some 9 million other Cathay Pacific accounts breached earlier this year.
The airline will no doubt be under fire for some time following these revelations – not least as they have erupted just one week ahead of the region’s largest aviation conference, likely prompting executives to scramble to assess their own vulnerabilities and ramp up data security in response.
However, every data breach serves as an important reminder that the conversation about information security needs to be taken seriously beyond financial services and insurance providers, which have traditionally been targeted. Airline passengers will understandably be concerned that their personal data has been captured by criminals, given the breadth of personal information an airline maintains, including passport or national ID numbers.
There are several key points that should be focused upon clearly. First, the problem is a cyber-risk problem, not a cybersecurity problem per se – and the goal is to use cybersecurity tools to strive for resilience. It is important, too, to be clear about resilience as there is in fact no such thing as complete security – although there is an acceptable level of risk.
In terms of translating the above to business leaders, whether for a supermarket chain, food-delivery app, or a bank, the focus now needs to be on determining how much a company’s cyber-risk is actually worth, in terms of impact on customers, share price, or reputation. From an information security perspective, the emphasis – across all industries – must focus on aligning security measures with risk.
With every business considering ways to benefit from digital transformation, companies need to look at ways to manage risk – starting with data classification.
Classifying data into distinct categories based on the sensitivity of the data and risk of harm if the data is breached allows a business to effectively and efficiently align appropriate security controls, such as encryption or other access control measures, according to relative risk.
The term ‘cybersecurity’ has entered popular lexicon, but the real objective is ‘cyber risk management,’ and that starts with data classification.
View the original article here
Photo by Amarnath Tade
