Private Equity Firms and Corporate Boards have a decision to make. With increased cyber-attacks happening globally, which will only increase with AI-driven hacking, Boards have to change their stance regarding the security and risk of the companies they manage.
Current board governance protocols are not keeping up with accelerating levels of risk. Ransomware, hacking, and data exfiltration are increasing despite current oversight. The costs of cyber insurance are skyrocketing, and, as the effects of a breach today are more impactful than ever, your cyber insurance company may not cover all monetary damages. This is particularly true because insurance companies are aggressively auditing claims in an effort to uncover a lack of controls or whether controls or processes were not faithfully followed.
Why?
Enter Drift. Drift is the gradual shift or deterioration of an environment from the original configuration that happens over time, is generally ad hoc, and is not recorded.
Myth: The current audit committee standard of an auditor following a checklist of security software solutions, penetration testing, and end-point protection will keep you safe.
Fact: If you examine recent high-profile cyber incidents, you come away with one inescapable conclusion. In each instance where an employee clicked a link or bypassed a step, the core protections that were audited and expected to mitigate the occurrence downstream either failed or simply weren’t there any longer, despite the original security setup being well-designed, well-intentioned, and complete.
These recent attacks all occurred at companies that are very good at what they do, and their IT teams are top-notch. However, building security up by layers, even if done correctly, does little good if base-level foundational controls are not present or become by-passable over time. It is a dirty little secret that one employee looking for an easier way to do something can lead to a change that creates a previously non-existent security problem. Over time these shortcuts and bypasses are almost inevitable, absent herculean efforts otherwise.
What is the solution?
Foundational Oversight. It is an ON-GOING and highly disciplined continuous improvement process. It is not hard, but it does require focus and accountability. Foundational Oversight has 4 activities that boards need to adopt and champion:
1) A thorough third-party assessment of the security setup at the companies they manage. An outside team needs to review the base configurations of your technology, Active Directory, permission controls, and service accounts; conduct data valuation and protect surface exercises and more. This is a ground-up re-examination of what was built and why, and what changes or exceptions have been built into the core of your infrastructure and connectivity over time.
2) A Security Improvement Plan (SIP)built, updated, and maintained by a 3rd party, that lays out the core, secondary, and tertiary improvements needed to lower your company’s risk.
3) Training protocols review and improvement. This is another area that, while it may be done, and done reasonably well, a wholesale review of what is needed (and what is unnecessary) should be a regular event.
4) A review and reaffirmation of Business Continuity Plans (BCP). With attacks happening more often, the assumption is now that a company will be attacked, and a Business Continuity plan must be developed and tested that can survive an attack– not just an outage. Make no mistake here, this step has to be refreshed regularly as technology stacks and configurations change constantly (see our comments about drift above!!). If it has been more than a year since development and testing of your full BCP, you are not in any way secure.
As a side note, a BCP has to contain two elements: 1) Recovery and 2) interim operations management processes (e.g., the work-arounds you will use while you are fighting the attack and recovering). That last one is almost always missed or given little attention, but it can be just as critical to saving your client base as the recovery itself. Your clients (and your sales teams) will thank you.
Foundational Oversight is not a one-and-done solution, but an annual set of events that needs to be continued and maintained over the life of the business, with each of the four steps being reexamined and renewed each year. Again, an outside company managing and monitoring these efforts on behalf of the board is critical.
PE Firms and Boards (and their CEOs as well) are the ones taking-on the risks of the companies they manage and maintain. It is up to them to put these foundational oversight steps in place on behalf of themselves and their shareholders.
