Executive Cyber Protection Is the Key to Keeping Your Company Safe Cybersecurity is essential for the success of any business, and it's important to start at the top – with the c-suite. Here's why.
By Andrei Komarov Edited by Amanda Breen
Opinions expressed by Entrepreneur contributors are their own.
There's a growing trend for cyberattacks to target a company's c-suite specifically. Recent studies have found that chief executive officers, chief technology officers and chief legal officers have access to data that makes them particularly tempting targets, which has resulted in them being targeted more often for cyberattacks. Because of the possible results of such attacks, protecting your company should start with a comprehensive executive cyber-protection plan.
Related: Cybersecurity is Now Essential to Corporate Strategy. Here's How to Bring the Two Together.
Why executives are such lucrative targets
There are a few reasons why executives make such potentially high-payoff targets. First, executives have access to the most sensitive data a company might have, often in the form of intellectual property or other business or trade secrets. Beyond that, though, they make good targets for ransomware attacks — particularly on their personal apps or devices.
There's a trend for cyberespionage groups to target executives' personal devices because they are typically much less secure than devices on an enterprise network. Executives are also humans, and as such, can fall prey to whaling attacks. Because they're such high-payoff targets, competitors or even nation-states are willing to spend significant time and resources learning about executives — their interests, preferences and potential weaknesses.
These threats aren't just hypothetical. Executives may be targeted when they visit regions of the world that are less stable than America for kidnapping or hostage situations. One company was able to thwart a planned attack during a conference in Latin America. The criminals were able to distribute malware to the executive's devices and were then able to find out flight schedules, itineraries and even where he was going to be staying. They posed a viable threat to him and his family, and timely intervention was the only way security teams were able to prevent something worse.
Who is targeting executives?
Advanced cyber-espionage groups and even nation-state threat actors are targeting executives at ever-increasing rates because of the valuable nature of their data. These groups often have considerable resources at their disposal and can also leverage insiders in the organization for access. For example, while they may know that an executive is well-protected, they might target lower-level employees first for account-takeover attacks. They then use these compromised profiles to send malicious emails to executives from a trusted source inside the company. The same thing can also be done from a third-party risk perspective when malicious payload is delivered from a compromised account of a partner or vendor.
Related: Putting Off Cybersecurity Is Putting You at Much Bigger Risk Than You Realize
How companies can protect their executives
Protecting your company's executives should be the first problem you tackle when talking about cybersecurity. It requires an integrated planning and execution process between cybersecurity, IT, physical-security professionals, threat intelligence and other professional resources to evaluate threats and implement mitigation strategies.
It may be cliche, but one of the most effective strategies is comprehensive user-awareness education – c-suite included. Executives are extremely busy and typically don't have time to stay up-to-date on the advanced threats that may be targeting them. Cybersecurity teams have a responsibility to protect their executives by providing easy-to-digest briefs on new threats and actionable intelligence for strategic decision-making. Executives are humans too, and they need to be reminded of how sophisticated social engineering or other attacks can be. The majority of successful cyber attacks have proven the human element is easily exploitable compared to technology — presenting one of the biggest infosecurity challenges.
These briefs should be precise and can be tailored to different regions of the world as well. Different areas may have varying threats and executives should be aware of the regions that may impact them and the business the most. This information is best coming from the CSO or the CISO, but some enterprises have found it beneficial to establish a new role, the chief risk officer (CRO), who is responsible for providing a comprehensive risk assessment to other executives.
Related: How Much Does Cybersecurity Really Cost?
Don't wait. Protect the c-suite.
Cyber attackers don't sleep. They're constantly on the prowl for vulnerable targets, and sometimes those can be the executives that have access to the most valuable data in a company (or who may command the highest ransom). Protecting your company necessitates protecting the c-suite. Executive cyber protection is a growing trend in the cybersecurity community because of a growing trend in c-suite executives being targeted. Don't wait; build a plan to secure your executives now.
