Shielding the treasure trove: cyber security strategies for preserving corporate finances

August 2023 | SPOTLIGHT | RISK MANAGEMENT

Financier Worldwide Magazine

August 2023 Issue

As the digital age continues to unfold, data has emerged as an immensely valuable asset, comparable to the preciousness of gold within the realm of corporate finance. This escalation in value has inevitably led to an amplified risk of cyber security threats, underscoring the urgent need for organisations to bolster their data management and security measures. In particular, businesses operating in the financial sector must proactively take steps to safeguard their invaluable digital assets and fortify their data against potential cyber threats.

Data’s increasing influence in corporate finance

The reliance on data has become a central pillar in the realm of business decision making and operations. This pervasive dependence extends across multiple facets of corporate finance, encompassing crucial areas such as risk management, forecasting, strategic planning and compliance. However, this reliance also exposes businesses to a newfound vulnerability: the potentially catastrophic consequences of a data breach.

In today’s interconnected world, where a company’s value is increasingly intertwined with its data assets, breaches can unleash a wave of severe financial repercussions. These consequences encompass not only hefty regulatory fines but also the disruptive impact on day to day business operations, the erosion of reputational standing, and the substantial costs associated with remedial actions and recovery efforts. To put things into perspective, the IBM ‘2022 Cost of a Data Breach’ report uncovered that the average total cost of a data breach for UK companies stands at a staggering £3.2m.

Common cyber security threats

The realm of cyber threats is as vast as menacing, encompassing a range of sophisticated techniques that can have severe repercussions for corporate finance. These threats include phishing attacks, ransomware incidents, denial-of-service (DoS) attacks and insider threats. Understanding the potential impact of each of these threats is crucial for organisations to develop effective cyber security strategies.

Ransomware attacks pose a direct and immediate risk to a company’s financial resources. These malicious attacks involve encrypting critical data until a ransom is paid to attackers. However, the fallout from such attacks extends beyond ransom payment itself. Organisations often experience operational disruptions as systems and files become inaccessible, causing delays and downtime that can result in significant financial losses.

Moreover, reputational damage inflicted by a ransomware incident can erode customer trust and confidence, leading to long-term negative impacts on corporate finance. Insider threats are equally significant risk factors. These threats can arise from deliberate malicious actions and unintentional mistakes made by employees or trusted individuals with access to sensitive data and systems.

Malicious insiders may intentionally sabotage financial processes, compromise data integrity or engage in fraudulent activities, causing substantial financial loss to the organisation. On the other hand, inadvertent mistakes by well-intentioned insiders, such as accidentally sharing confidential information or falling victim to phishing attacks, can also have financial consequences for the company.

The financial implications of cyber threats go beyond the immediate financial losses. They encompass intangible costs such as reputational damage and loss of customer trust. Organisations that fall victim to cyber attacks often suffer from negative publicity, which can tarnish their brand image and affect customer loyalty. Rebuilding trust requires time and resources, with potential repercussions on revenue streams and long-term profitability.

Mitigating these risks requires a multilayered approach. To combat ransomware attacks, organisations should implement robust backup and disaster recovery mechanisms, ensuring that critical data are regularly backed up and can be swiftly restored in the event of an attack. Investing in advanced threat detection and prevention systems, such as next-generation firewalls and intrusion detection systems, can bolster defences against various cyber threats including ransomware and DoS attacks.

Employee awareness and education play pivotal roles in mitigating both insider and external threats. Regular training programmes can empower employees to recognise phishing attempts, adopt strong password practices and adhere to cyber security policies. Also, implementing strong access controls, such as least privilege principles, and conducting periodic reviews of user access rights can help to limit the potential damage caused by insider threats.

Organisations must prioritise ongoing vigilance and adaptability to maintain a robust cyber security posture. This involves staying abreast of emerging threats through regular threat intelligence analysis and monitoring, conducting regular risk assessments, and proactively patching vulnerabilities in the software and systems. Developing an incident response plan and regularly testing it through simulated scenarios can enable swift and effective responses to cyber incidents, thereby minimising the financial impact and recovery time.

Mitigating risks with proactive measures

Mitigating these risks requires a comprehensive and multifaceted approach that encompasses a range of strategies. Technical measures play a pivotal role in fortifying cyber security defences. This includes implementing robust encryption protocols to protect data both in transit and at rest. Additionally, organisations must maintain up to date firewalls and intrusion-detection systems to thwart potential cyber threats. Regular system audits further ensure that vulnerabilities are promptly identified and addressed. Embracing a zero-trust approach, rooted in the principle of ‘never trust, always verify’, bolsters the resilience of the organisation’s security framework.

Equally critical is the investment in workforce education. Given that a significant number of breaches stem from human error or a lack of awareness, organisations must prioritise regular and comprehensive cyber security training programmes. These initiatives empower employees to recognise and respond effectively to potential threats, enhancing the overall security posture of the organisation.

Moreover, fostering a cyber security culture should extend to board level. Board members play a pivotal role in setting the tone for the organisation’s approach to cyber security. By demonstrating a deep commitment to cyber security, they convey the seriousness of these risks to the entire company. This top-down approach reinforces the importance of proactive measures, encouraging employees at all levels to prioritise cyber security in their daily practices.

By adopting a multidimensional strategy that encompasses technical measures, workforce education and a board-level commitment to cyber security, organisations can effectively mitigate the risks associated with cyber threats. This holistic approach ensures that the organisation is well-prepared to navigate the evolving cyber landscape and safeguard its financial assets and reputation.

Legal and regulatory landscape

Regulations such as the General Data Protection Regulation (GDPR) and the Network and Information Systems (NIS) impose stringent data protection standards on companies, placing a significant emphasis on the importance of robust cyber security practices. Failure to comply with these regulations can result in severe financial penalties, thereby highlighting the substantial risks associated with inadequate cyber security measures.

Under the GDPR, companies found in breach of its provisions can face fines of up to £17m or 4 percent of their global turnover, whichever is higher. This demonstrates the substantial financial consequences that can arise from noncompliance. Moreover, NIS regulations also carry significant penalties for noncompliant organisations.

The GDPR aims to protect the personal data of individuals within the EU and European Economic Area (EEA) regardless of where data processing takes place. It establishes strict requirements for obtaining consent, ensuring data security, and notifying authorities and affected individuals in the event of a data breach. By enforcing these requirements, the GDPR promotes the transparency, accountability and responsible handling of personal data.

Compliance with the GDPR involves implementing appropriate technical and organisational measures to ensure confidentiality, integrity and availability of personal data. This includes measures, such as pseudonymisation, encryption, regular data backups and access controls. By adhering to these measures, companies can minimise the risk of data breaches and protect the financial wellbeing of their organisations.

Similarly, NIS regulations aim to enhance the security of networks and information systems across critical sectors, including finance. These regulations require organisations to take appropriate security measures to prevent and minimise the impact of cyber security incidents. By identifying and mitigating risks, organisations can enhance the resilience of their systems and safeguard sensitive financial data.

In addition to financial penalties, non-compliance with data protection regulations can result in reputational damage to organisations. A data breach or inadequate data protection measures can erode customer trust, leading to the loss of business opportunities and potential legal actions from affected individuals.

Therefore, it is crucial for organisations in the corporate finance sector to prioritise cyber security and data management. By investing in robust security measures, regularly updating their systems and conducting thorough risk assessments, businesses can proactively protect their finances, maintain compliance with regulations and uphold their reputations as trustworthy custodians of sensitive data.

The necessity for vigilance and adaptability

In the rapidly evolving landscape of cyber threats, complacency is simply not an option. To effectively protect their valuable data, financial organisations must remain vigilant, staying well-informed about the latest threats, regularly updating security protocols and establishing a comprehensive incident response plan. These proactive measures are crucial in safeguarding corporate finances.

As data assumes an increasingly pivotal role in the realm of corporate finance, organisations must take proactive steps to fortify their data management and cyber security measures. By doing so, they not only shield their financial resources but also uphold their reputation, ensure compliance with regulations and ultimately secure their most precious asset in this digital era: their data.

Julien Chaisse is a professor of law at City University of Hong Kong. He can be contacted on +852 3442 6594 or by email: julien.chaisse@cityu.edu.hk.

Julien Chaisse

City University of Hong Kong