CIR BC Strategies for Processes

CIR BC Strategies for Processes

This article discusses the preventive, mitigation and recovery strategies for protecting the Processes.  These strategies are:

1. Encryption
2. Continuous Improvement
3. Penetration Testing/ Simulation Exercises

1. Processes: Encryption

Encryption refers to the conversion of sensitive organizational information into complex codes (NCI, 2015) that is unreadable by humans using algorithms, increasing the difficulty encountered by cyber criminals to gain access to the information.

Only possession of the correct ‘key’ can decrypt the information into its original form. Sensitive information in IT infrastructures or transferred via the network should be encrypted (Florida Tech, 2017) as these platforms are common targets of cyber criminals.

The ‘key’ can be kept protected with multi-factor authentication procedures.

2. Processes: Continuous Improvement

There is no one-way solution in dealing with cyber security incidents. Every organization utilizing information assets is susceptible to cyber security attacks. The differentiating factor between organizations is how impacts associated with the respective cyber security threats are mitigated or minimized. As technology develops, the techniques deployed by cyber criminals become more complex. Organizations must continuously adapt and improve the processes of utilising their information assets so that disruptions to CBFs are avoided or reduced.

See Appendix 21 for more details on the different methodologies for continuous improvement. [Under construction]

3. Processes: Penetration Testing/ Simulation Exercises

For organizations to install effective countermeasures against cyber security attacks, putting themselves in the role of a cybercriminal allows them to understand the mindset and outline the paths that cyber criminals can utilize to attack their organizations.

Mapping out cyber criminals' attack vectors (Shortridge, 2017) also allows organizations to identify which areas require strengthening security controls. The effectiveness of the implemented security controls is evaluated to determine if they can mitigate potential cyber security attacks.

Simultaneously, the attack pattern of cyber criminals may be disrupted with corrective actions implemented after tests or exercises, halting their learning curve and ability to profile the organizations, making their cyber security attack less likely to succeed.

Component of PrEvention/ Mitigation CIR BC Strategies

Do You Want to Continue BCM Training onsite or online?

Goh, M. H. (2017). A Manager's Guide to Business Continuity Management for Cyber Security Incidents, 2nd Edition. GMH Pte Ltd.

Reference: Chapter 7 Developing Mitigation and Response Strategies 7.21 Processes

Note:  This version was the draft 2nd Edition being updated in 2023. The numeric in the square bracket [X-X] cross-refers to the actual chapter and section in the 1st Edition.