We all know that Kings and Queens have stored their most prized possessions such as crowns, robes, and other items of their ceremonial regalia under tight lock and key at the Tower of London for over 600 years.
However, did you know that “Crown Jewels” is a metaphor for the most critical digital assets of your business? These assets must be protected at all costs for your business to maintain its operational integrity. In the digital world, Crown Jewels can be represented by a variety of assets including:
- Personal information (think GDPR).
- Network and database systems.
- Websites & Applications.
- Laptops, tablets & mobiles.
- Human resources data.
- Customer data.
- Business confidential data (plans, patents, legal documents, etc).
In business we all create weekly, monthly, quarterly and annual plans. However as we emerge from the global pandemic all businesses should be making Cyber Security an integral component of their 2021 vision.
Cyber Criminals have also been making 2021 plans!! They have used their time very wisely, refining their business models, expanding their talent pools, and covertly scanning the Internet 24*7 to identify the cracks in your defences. These individuals, groups and global networks of criminals have invested huge sums of money to arm themselves with the most advanced tools and tech available, their 2021 vision is simple.
- Identify targets (prospects).
- Gain a small foothold into target systems.
- Silently and covertly expand their access privileges within compromised systems.
- Identify the Crown Jewels within compromised systems.
- Covertly exfiltrate, encrypt or modify your Digital Crown Jewels.
- Hold your business to ransom.
Organisations that are reviewing their Cyber Incident response plans or even those that are looking to improve their Cyber Security maturity need to focus on identifying their critical assets or Crown Jewels as one of their top three priorities 2021.
It’s quite simple, you can’t protect an asset you don’t know you have!
Without having an accurate asset inventory, a business cannot design an effective and focussed Cyber Incident response plan or for that matter be Cyber-Secure unfortunately there is no easy way to identify the Digital Crown Jewels of your business as these critical assets can vary from industry to industry.
As we have discussed numerous times, Cyber Insurance is something that every business should have these days and it should be seen as a cost of doing business, akin to buildings insurance, public liability insurance etc. Unfortunately, Cyber Insurance is not going stop Cyber Criminals, just because you have contents insurance doesn’t mean you won’t get burgled!
Typically when a business has invoked their Cyber Insurance policy claim the horse has bolted and the stable door is left wide open. Businesses need to keep pace with the criminals and be alerted when they are trying to gain access or indeed be alerted when sensors are triggered indicating the criminals are inside our systems.
This gives us the opportunity to stop the criminals before the damage is done and prior to invoking Cyber Insurance claims. Cyber Criminals have invested in attack tools, in contrast businesses must invest in defensive tools and services.
Tycom have also used the time wisely building our new range of Cyber Defences to be compliant with National Institute of Standards and Technology (NIST) Cyber Security Framework. NIST Founded in 1901, NIST is a non-regulatory federal agency within the U.S. Department of Commerce.
The NIST Cyber Security Framework is broken down into five functions which represent the five primary pillars for a successful and holistic Cyber Security program. They aid organizations in easily expressing their management of Cyber Security risk at a high level and enabling risk management decisions.
- The Identify Function assists in developing an organizational understanding to managing Cyber Security risk to systems, people, assets, data, and capabilities. Understanding the business context, the resources that support critical functions, and the related Cyber Security risks enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs.
- The Protect Function outlines appropriate safeguards to ensure delivery of critical infrastructure services. The Protect Function supports the ability to limit or contain the impact of a potential Cyber Security event.
- The Detect Function defines the appropriate activities to identify the occurrence of a Cyber Security event. The Detect Function enables timely discovery of Cyber Security events.
- The Recover Function identifies appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a Cyber Security incident. The Recover Function supports timely recovery to normal operations to reduce the impact from a Cyber Security incident.
- The Recover Function identifies appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a Cyber Security incident. The Recover Function supports timely recovery to normal operations to reduce the impact from a Cyber Security incident.
Prioritising the Identify, Protect and Detect functions in 2021 will dramatically reduce the risk of the stable door being flung wide open in the middle of the night.