Five ways business leaders can foster a security-first mindset

By Scott Hesford, Senior VP, Solutions Engineering Asia Pacific and Japan, BeyondTrust

Concept artwork on cybersecurity generated by Blue Willow.

News headlines have recently been dominated by incidents of data breaches and cyberattacks, highlighting the worrying dynamic cybersecurity threat landscape globally, but also within Asia.

From a corporate perspective, senior business executives find themselves leading the charge in the battle against these sophisticated attacks. The solution: adopting a security-first mindset.

Regardless of technical expertise, business executives have had to become champions of security within their organisations. They are tasked with fostering a strong, security-forward culture to protect against these growing threats.

According to the Singapore Police Force’s (SPF) Mid-Year Scams and Cybercrime brief, alarmingly, in the 1H24, the total number of scam cases was 26,857, and a total amount of S$385.6 M was lost. Such attacks bear not only financial repercussions to victim organisations but also damage brand reputation. Recovering a damaged corporate image caused by a data breach is often painstaking and costly. Therefore, security has turned into both a financial and strategic imperative for business executives.

In efforts to promote better security hygiene, the Cybersecurity Agency of Singapore (CSA) launched its 5th National Cybersecurity Campaign in September 2023, The Unseen Enemy. The campaign urged employees to protect themselves online or risk losing data and money to bad actors.

Business leaders – regardless of their roles – can follow five key strategies to instil and nurture a security-first mindset within their teams and organisation. Those strategies are:

Conduct a holistic risk assessment

To foster a security-first culture, C-suite leaders must start by conducting a holistic risk assessment. Having this type of foundational understanding is crucial for leaders before diving deeper into the granular details of protective strategies and measures. To start, executives must take a step back and objectively identify high-level enterprise risks, both from an outside-in and inside-out perspective.

A comprehensive risk assessment will enable executives to get a fuller picture of their organisation’s security vulnerabilities, which then allows for better strategic allocation of resources. It will also lead to better alignment of security measures with business-critical areas. Armed with the results of this detailed risk assessment, executives have a roadmap for addressing vulnerabilities, strengthening their organisation’s security posture, and fortifying against potential threats.

Partner with security experts

CEOs must invest in and partner with subject matter experts, particularly in the form of a CISO and a dedicated security team, because while senior business leaders often have a comprehensive perspective of their enterprises, the complexities of cybersecurity require a cross-functional approach.

Security experts provide vital insights into the evolving threat landscape. They help support the C-suite in staying updated on potential security risks. Additionally, CISOs are a strategic ally to CEOs as they can help the latter better understand, prioritise, and navigate security-specific challenges that lie ahead.

A collaborative partnership between CISOs and the rest of the C-suite will ensure a holistic cybersecurity perspective within the organisation. This includes a better view on enterprise security gaps, suggested focus areas, and strategies for managing day-to-day risks. 

Provide internal and external protection

Leaders must remember that a security-first mindset goes beyond simply protecting corporate assets. It also covers the protection of clients and partners. Business leaders must prioritise the implementation of internal tools designed to monitor and, ideally, prevent network breaches, with the understanding that customers and their data are collateral damage during a breach.

Every breach, from service disruptions to direct threats arising from compromised personal information, can have a profound impact on the customer experience. Leaders must have a deep understanding of their company’s data – from how it is used internally and within the organisation’s products and services.

Having this understanding will create a strong foundation for leaders in developing strategies to protect critical assets, which include customer data. Doing so will strengthen the trust and loyalty of the organisation’s customer base.

Undertake proactive employee education

A consistent and significant security vulnerability is the human factor. Leaders can address this by adopting a proactive approach towards employee training. It should go beyond teaching them how to handle typical hacking scenarios. Instead, employees should be trained on social engineering tactics, which are becoming a major cybersecurity attack vector.

Indeed, routine education must become an essential line of defence. In that vein, CSA, in collaboration with Infocomm Media Development Authority (IMDA) launched the Cybersecurity Health Check for organisations to assess their cyber hygiene, benchmark themselves against industry peers, and access resources to address any gaps. This self-assessment tool was developed based on the cyber hygiene measures in Cyber Essentials.

Continue a process of self-learning

The continuous learning journey is also key for non-security business leaders who may feel overwhelmed by the intricacies of cybersecurity. Cybersecurity is a complex and evolving subject, so every leader must stay abreast of current trends so that they are better able to prioritise security for the benefit of their customers and employees.

A range of resources is available to leaders to facilitate this journey. Executives can delve into webinars, blogs, whitepapers, and newsletters to gain insights into the overarching cybersecurity landscape, threats, and best practices. 

Joining a local industry body, such as the Association of Information Security Professionals (AiSP), can also be helpful for learning and networking. Leading with a security-first mindset has never been more crucial. Maintaining an objective perspective on the evolving threat landscape, investing in the right talent, staying vigilant, and emphasising routine employee training will enable leaders strengthen their organisation’s security posture by laying down a robust foundation.

In a time of ever-increasing stakes, these strategies are essential building blocks for resilience in the face of a continuously evolving cyberthreat landscape.