Chairs and risk committee members have the power to minimise cyber risk and empower portfolio companies to safely and swiftly recover from cyber-attacks.
Traditionally, boards that manage risk scorecards have seen major risks change from quarter to quarter, and year to year, influenced by economic conditions, political factors, supply chain issues, and consumer buying patterns. These factors have always naturally ebbed and flowed depending on the nature of the business and the sector, and government and industry policies.
But this landscape has fundamentally changed. Today, every private equity (PE) firm that systematically evaluates, quantifies, and manages risks must understand that cyber risk is undoubtedly the single biggest risk for its business and for each of its portfolio companies. Not only is it the risk that is most likely to occur, but it also carries the deepest consequences if it becomes a reality.
With cyber risk the greatest risk the sector faces today, the chair and risk committee of every PE portfolio company need to place cyber security at the top of the risk agenda – guided and supported by the PE firm. The chair and risk committee are accountable, and the onus is on them to act decisively before it’s too late. Therefore, they must proactively take two important steps to protect their most valuable assets:
- Strengthen the firm’s cyber security posture and
- Build cyber resilience in case it is compromised.
Both can be done through a robust cyber security strategy.
Fortify security and boost resilience
Prevention is better than cure, but in today’s highly unpredictable threat landscape, no organisation can guarantee it won’t be compromised. That’s why it’s essential to build a strong cyber security posture and resilience for any eventuality.
Despite the omnipresent threat of cybercriminals and cyber-attacks, there’s no need to panic or be alarmist. However, it is essential for the chair and risk committee to take cyber threats with the same seriousness as any other threat to the PE firm or any of the portfolio companies. Fortunately, there are tried and tested actions that decision makers can take to fortify the cyber security posture of a company and make it significantly more robust.
By strengthening cyber security, a company effectively reduces the chances of a cyber-attack from being successful in the first place. And by improving resilience, the company can return to business as usual quickly and safely with the least possible disruption to its business.
Start with self-assessment
Rather than rush to buy the latest best-of-breed tools to defend every specific component of the entire IT estate, it’s wiser to begin with a cyber risk assessment (CRA). This allows an organisation to start by understanding the exact state of its cyber security posture and think about where it would like it to be.
Monitoring, detecting, and responding to incidents
Cybercriminals are professionals and work around the clock. So, any PE firm needs to implement continuous monitoring, detection, and response capabilities across its whole IT ecosystem. This is catered for by a managed detection and response (MDR) service run by an external qualified team of cyber security analysts. This team is often called a Security Operations Centre, or SOC for short. The SOC team should have eyes on your systems 24/7, 365 days a year, and collaborate with an Incident Response (IR) team that‘s ready to respond to any cyber incidents at any time of the day or night.
Preparation and planning
The name of the IR team perhaps leads business leaders to think that it is only activated to respond after a cyber incident. But this team should be employed well in advance. One of an IR team’s specialities is to prepare a business for the worst-case scenario. PE firms should bring the IR team in to help them plan for any cyber-attack and run tabletop exercises. These are the equivalent of emergency fire drills so that everyone knows what to do, who to communicate to, and when, in the event of a compromise.
For an IR plan to be useful, it needs to be regularly reviewed and practised. Historical cases of cyber-attacks demonstrate clearly that companies that thoroughly prepared and planned for them came through incidents in much better shape than those that didn’t. Those that plan and practice have even impressed business stakeholders with their achievements in handling such an unenviable situation. Handling an incident well can also affect the reputation of the business and its leaders and reduce cyber insurance premiums.
Take the next step to stronger cyber security
Businesses can go further still. By adopting a threat-led approach to cyber security, PE firms and portfolio companies can better anticipate and defend against potential attacks, making their security posture more resilient and adaptive to the evolving threat landscape.
A Threat Intelligence (TI) team can assess threats more likely to impact an organisation based on factors such as:
- Industry
- Region
- The stage of the deal cycle.
TI experts study which cybercriminal groups and nation-state actors target the sector and region, and which tactics, techniques, and procedures (TTPs) they use. This intelligence can help the company secure any vulnerabilities and be on guard for suspicious activities.
A threat-led approach emphasises the proactive identification and analysis of potential threats to the firm’s digital infrastructure.
Take decisive action today
As a Microsoft Solutions Partner for Security with a 350-strong team of experts in the UK, the US, and Canada, Quorum Cyber provides a comprehensive range of cyber security and data security services, and has deep expertise in the private equity world.
If you would like to discuss how Quorum Cyber can help protect your PE firm and its portfolio companies, please contact us today.
