Unmissable Insights To Help Build Your Cyber Security Strategy In 2024

Almost half (46%) of businesses experienced a data breach in the last 12 months, according to the government’s Cyber Security Breaches Survey 2017, and organisations need to be aware of the security risks that new cloud-based software, like Office 365, may bring about.

Put simply, your cyber security strategy is there to help your business survive and thrive in a world of constantly evolving and emerging cyber threats, and when delivered and implemented correctly, could really give you a competitive edge.

Here at Doherty Associates we strongly advocate a ‘risk-based approach’ where you proactively identify the risks to your organisation, the results of a possible attack, then take steps to reduce and mitigate this risk.

In this blog, packed with expert insights, we’ll demonstrate the steps you need to take to craft your cyber security strategy for 2024 and beyond.

Key Elements of a Comprehensive Cyber Security Strategy

Your cyber security strategy is your plan to protect your business from cyber security threats. It sets out what a safe cyber environment looks like based on industry-wide best practices and factors unique to your business.

When considering what you need in your strategy, a great place to start is to take a look at the NIST Framework.

The NIST framework is a series of guidelines to help you create your cyber security strategy. Created by the National Institute of Standards and Technology in the US****, NIST helps large and small businesses follow industry-wide best practices to boost their cyber resilience.

The NIST framework consists of five components (or pillars):

Identify – What types of threats pose a risk to your business? What assets are at risk?
Protect – What’s the best way to safeguard the assets you’ve identified?
Detect – How will you detect cyber threats against your assets?
Respond – If you identify cyber security threats, what will you do next?
Recover – If a cyber threat damages your infrastructure, how will you fix it?

Our recommendation is for businesses to focus on a cyber security strategy leveraging the principles of NIST. Armed with this knowledge, you can create a strategy aligned to your goals that also supports you to allocate your budget efficiently.

Using the five NIST pillars as your guide, you can then add other components to your cyber security strategy.

15 Cyber Security Components to Consider in your Strategy

1 – Employee Training and Awareness

A study by IBM found that 95% of cyber breaches resulted from human error*****. Your strategy should include educating your workforce on cyber security best practices. There are a wealth of providers who can help you to deliver cybersecurity awareness training to your teams, covering everything from how to spot a malicious email to how to set robust passwords.

2 – Vulnerability Management and Patching

If you have legacy software sitting unused on your system that’s not getting updated, you leave your system (and your business) vulnerable. Cyber attackers target weak points in old software as their entry point into a system. Your cyber security strategy should include removing unused software and ensuring all your applications are up-to-date with the latest security patches.

3 – Threat Intelligence and Security Monitoring

Knowing the current techniques cyber attackers are using (threat intelligence) and detecting when you are targeted (security monitoring) are key tools in cyber defence. Armed with this information, you and your teams can foresee what cyber attackers may do next and take necessary precautions to protect you now and into the future.

4 – Identity and Access Management

User identity is key when working in the cloud. Proving that an individual is who they say they are, while avoiding repeated login attempts or arduous MFA prompts is important to ensure security without penalising productivity. Simplifying this using a single user account and providing access to all systems using it can centralise security logging and reduce the burden (for example multiple sets of usernames and passwords) on the individual.

The most effective way to ensure only the people you want have access to your system is to adopt a ‘zero trust architecture’. Microsoft****** calls this principle, ‘Never trust. Always verify’. In today’s world of remote work and distributed teams, it could be invaluable.

5 – Incident Response

Cyber threats are real and sometimes things do go wrong. It’s how you deal with it that matters.

With appropriate security controls in place it’s common to detect threats, but promptly answering these questions and taking appropriate action is important:

Was it a targeted attack?
Was it successful?
What is the exposure?
Do you need to notify the ICO?
Should it be considered a security breach?

6 – Business Continuity Planning (BCP)

Business Continuity Planning is about having a plan in place for how to continue with operations when a disaster happens. An event could be a security breach or natural disaster, something affecting access to the office or to online systems.

BCP includes defining scenarios, then ensuring appropriate measures are in place to allow continued operations. As an example, this may involve technologies such as high availability, replication, or parallel systems.

Industry experts call this cyber resilience. Ensure it’s part of your strategy.

7 – Artificial Intelligence and Machine Learning in Cyber Security

Because Artificial Intelligence (AI) and Machine Learning (ML) models can analyse vast amounts of data quickly, identifying patterns or anomalies that no human could ever spot, they lend themselves extremely well to cyber security protection.

There are many use cases for AI and Machine Learning in cyber security, including web filtering, threat hunting, vulnerability management, and malware management. New technologies including Generative AI, Chat GPT and Microsoft Co-Pilot are available to help you take advantage of these benefits. Modernise your cyber tech stack and don’t be left behind.

8 – Automated Threat Detection and Response

AI and ML can be used to automate threat detection by analysing historical data of known cyber threat events – identifying the patterns, anomalies, and signs that a system has been breached. Armed with this knowledge, your threat detection is proactive, not reactive.

9 – Behavioural Analytics and Anomaly Detection

Business analytics can reveal insights into systems and user behaviours. Analysing network traffic, system logs, and user activity to identify patterns, anomalies, and potential threats. Both behavioural analysis and anomaly detection can be used to automate and improve decision making and respond to advanced cyber threats.

10 – Regulatory Compliance and Legal Considerations

If you experience a cyber attack, it’s not just bad for your business and your reputation; it can land you on the wrong side of regulations if you don’t take appropriate action.

As part of your cyber security strategy, aim to comply with relevant industry standards, such as Cyber Essentials Plus and ISO 27001. ISO 27001 is an international standard for information security management, applicable to companies of all sizes *******.

Cyber Essentials Plus is an industry standard from the UK’s National Cyber Security Centre. It shows that you have the tools and knowledge to prevent the most common cyber attacks in your business. It also includes a technical verification.

It’s important to distinguish between these standards, which are optional, and compulsory ones such as GDPR and FSA regulations (in Financial Services). Ensure you understand your compliance priorities.

11 – Privacy Regulations and Data Protection

You have an obligation to keep your customer’s data private and secure, taking all appropriate actions to safeguard it from cyber threats. You’ll have heard of GDPR, which details your responsibilities for using personal data and the privacy of that data. It’s good practice to familiarise yourself with it and incorporate this data compliance into your wider cyber security strategy. There is a wealth of information out there to support you with your data privacy responsibilities, but your responsibilities may not end there. Computer Weekly lists the top 5 legal and regulatory compliance concerns for UK businesses as GDPR, the DPA, PECR, PCI-DSS, and the CCPA. **********

12 – Industry-specific Compliance Requirements

Depending on your industry, you may have other cybersecurity regulations to follow.

For example, in financial services, the FCA has a list of rules around cyber security, including reporting any material cyber-attacks where data is lost, or malware affects your system. Other industries with their own specific regulations include food, gambling, health and social care, education, legal and property finance. *********

13 – Building Partnerships and Collaborations for Cyber Security

By sharing information on cyber security with your network, you can help others safeguard their systems – and they’ll do the same for you. In the end, everybody wins, as you can move faster to address threats, reduce costs, and keep your businesses up and running.

There are plenty of cyber security users groups you can join and tap into for knowledge and support. Digital Guardian has a handy list you can check out here.

14 – Sharing Threat Intelligence and Best Practices

Create a process where you and trusted partners can share details of the threats they’re experiencing in real time. Again, it can help everybody face down bad actors and keep their companies functioning. Flare IO have created a useful list of the Top Cybercrime Forums to Monitor in 2023.

15 – Coordinated Incident Response and Cyber Exercises

Finally, like a fire drill, train your teams on what to do in the event of a cyber attack. Make it part of your overarching cyber security strategy. It will help you understand the effects of a cyber attack, how you will respond, and the recovery process. It will also help you comply with relevant regulations. Lots of cyber vendors out there have blueprint cyber incident response plans you can download and review. This handy checklist from Microsoft also has some great tips on how to respond to a cyber incident.

Conclusion

Hopefully this blog has given you plenty of actionable advice to ensure your 2024 Cyber Security Strategy is as robust as possible. As we have demonstrated, developing a robust cyber security strategy is essential for your business. But, as you can see, there’s a lot to it. That’s where a Managed Services Provider (or MSP) can help you. Partnering with an MSP brings specialist expertise into the streamlining process, delivering to your business:

Cost savings
Knowledge
Scalability
Productivity
Peace of mind

Other providers may recommend working with an MSSP specialising in cyber security. An expert MSP however can deliver the best of both worlds, providing networking and infrastructure knowledge as well as security expertise.

Selecting the right MSP for long-term success is essential – one with the experience, reputation, service offerings, and pricing to suit your business needs. Then, you can reap the rewards.

To find out more about Doherty Associates, visit our Services page.