Five steps to a good cybersecurity policy

Joris De Groot

Written on 13 Dec 2023

Joris De Groot
IT manager against cyber attacks

How and where to invest in cybersecurity?

In the rapidly evolving world of business operations, cybersecurity has become a critical part of the success (or failure) of any business. As the leader of your IT infrastructure, you face the challenge of not only growing your business, but also protecting your digital assets from increasingly sophisticated threats.

But where do you put your resources? What are good investments and what are the real musts?

Why it's best to invest in cybersecurity

In case you're still wondering anno 2024 why you need a security policy, I unfortunately have to beat around the bush with depressing numbers.

  • The first half of 2023 saw a 143% increase in ransomware victims.
  • The average cost of one data breach is about 4.5 million euros.
  • Since 2021, a 68% increase in hacking incidents was noted, and after the start of the war between Russia and Ukraine, the number of reports rose even more spectacularly.

The world is changing, that much is clear.

What adds to the problem is that the unstoppable rise of AI tools keeps increasing the clout of malicious organizations. IT security companies are also developing cybersecurity applications that employ AI and are in the midst of a veritable arms race.

So protecting sensitive data must be a priority.

Whether it is customer information or trade secrets, a breach can lead to not only financial losses but also damage customer trust and the company's reputation. And this risk is increasing every day. Financial losses from a cyberattack can be significant, ranging from recovery costs to lost revenue and lost customers.

A forward-looking security policy can reduce these potential losses and protect the company's financial health.

1. Invest in training

One statistic also very important to know: 74% of cybersecurity breaches are due to human error.

And there lies immediately your first good investment: your employees.

Every link in the chain is a potential target. When you invest in training and draw general attention to the problem, you ensure that each individual employee also cares about what he can control himself.

2. Engage in active management of authentication data

A second, low hanging fruit, is adopting and mandating a secure method of authenticating each employee. This is basically a combination of these things:

  • An SSO authentication that assigns roles -and permissions and that each application integrates with. That way, your employees sign in with one set of user credentials. Such an application can also enforce that a password meets certain requirements and will also request that the user change their password regularly.
  • A password manager. An application that allows secure storage of all kinds of login data takes away a piece of the worry. No more insecure passwords, no more storing passwords in the browser,... etc.
  • Use more advanced authentication methods such as passkeys and require 2 factor authentication when using passwords. This is a good way to prevent hackers from easily accessing your data. With two-factor is logging in with username/password combined with an extra step, for example through an authenticator such as microsoft authenticator.

3. Make sure you have a proper backup strategy

Backups are an essential part of a company's IT security strategy. It is your security that you can fall back on in case something has gone wrong.

A good backup policy is crucial for businesses to prevent data loss, ensure business continuity and comply with legal requirements. It also protects against cyber threats and helps maintain customer trust. In the long run, it can save costs by making data recovery more efficient.

4. Establish a security charter

With a security charter, you establish the ground rules and requirements that all your partners and suppliers must meet in order to work with you.

Trust is the foundation of the relationship between IT companies and their customers. A strong security framework is not only an operational necessity, but also acts as a powerful signal to customers that the company takes their privacy seriously.

Signing this charter does not buy security, of course, but it does impose some obligations on other parties. That makes it a good investment. You thereby reduce the risk of working with partners who don't take security very closely.

Drawing up a security charter is something you can let us help you with. Have more questions?

Contact us

5. Test and refine implemented measures

After you have implemented the necessary measures within your company validate whether they have all been implemented correctly and continue to do so at regular intervals.

Additionally, you can have pen tests performed on your company's critical infrastructure. Pentesting, or penetration testing, is important for businesses because it identifies IT security weaknesses, identifies risks, helps prevent breaches and is often required to meet security standards.

On the other hand, checking backups is essential to prevent data loss and ensure business continuity. Test that they are complete and that you can restore the full data set and functionalities with the backups you created. The last thing you want is to find out that your backup strategy was insufficient when you really need them.

Need advice?

We are the data-driven digital experts.

Contact us