- Proactive, results-oriented, cross-cutting professionals with great analytical skills.
- We explain the procedure the HR department needs to follow to integrate a plan that minimises the risks and the impact of a security incident.
The latest Risk Report from the World Economic Forum ranked cyberattacks and data theft as two of the five main risks. According to this report, the cost of cybercrime to companies in the next five years could reach 8 billion dollars.
Every entity that has an online presence, generates information through its business activity, or whose systems are hosted in the cloud is exposed. Luckily, organizations are beginning to realise the need to develop a plan that minimizes the risks and impact of a security incident. The enormous repercussions of events like the one that happened last year with the ransomware “Wannacry” macro attack have set off alarm bells.
Cybersecurity profiles are playing a fundamental role in organizations and are supporting the creation of new teams from managerial positions.
Among others, the most in-demand cybersecurity positions are: Ethical hacker, CISO, CSO and DPO. Different types of professionals responsible for managing this issue are:
-
CISO (Chief Information Security Officer): Responsible for aligning the cybersecurity strategy with the company’s objectives. In charge of establishing security policies based on the activity of the company and setting up the necessary measures and controls.
- CSO (Chief Security Officer): Responsible for the internal security of the organization. Establishes continuity plans, has a complete vision of the business, is up to date with regulatory changes, knows the possible risks in cybersecurity, etc..
-
DPO (Data Protection Officer): Has a legal and regulatory compliance profile and, according to the new European Data Protection regulations, will be a mandatory position in Public Organisations and in certain private companies.
-
Security Analyst: In charge of detecting any possible technical vulnerabilities in the company’s computer systems and networks.
Security Architect: Responsible for designing the prior cybersecurity architecture to ensure all developments in the environment are secure.
-
Ethical hacker: Up to date on the techniques used by cybercriminals. Tests companies’ security systems to analyse potential hazards and thus solve them.
-
Forensic Specialist: Specialises in performing thorough postmortem analyses of systems and networks after a security or cyber-attack incident.
-
Incident Specialist: Responsible for coordinating activities should security incidents occur and is responsible for activating the control plan so that the teams work in alignment and that incidents have the least possible impact.
-
Head of intelligence: Expert in detecting and analysing external threats to protect the company’s reputatio
What skills are necessary? Although the skills will vary, generally speaking, we can say that cross-cutting knowledge, great analytical skills, and knowing how to work under pressure are required. At the technical level, they must be able to draw up plans to safeguard computer files; be proficient in the management of different operating systems, networks and programming languages; implement cryptographic protocols and security tools; analyse and detect threats and develop techniques to prevent them; know the current regulations and have a good command of malware analysis, among other capabilities.
How can these profiles be integrated into the organization? Depending on the size of the company, these professionals will be integrated differently. If they are hired internally, they are usually placed in the IT, Systems and Cybersecurity or R&D departments. However, they must always work closely with management and have a generalised approach that takes the other departments in the organization into account.
Internal training is of high importance. According to the latest data, more than 90% of security breaches are caused by non-compliance of the protocols by staff. That’s exactly why certain basics that protect the security of the company must be put into place: the identity of anyone who requests information must be confirmed; strong passwords should be used; the saving of sensitive company information on hard disks should be avoided, the installation of programs from unknown sources should be prohibited, antiviruses on computers must always be updated…
Take out a cyber insurance policy. Many insurers offer cyber risk insurance as a solution to possible threats. They usually cover both the damages to the company as well as the economic damages that may be caused to third parties or to the employees themselves. Of course, to be able to take one out, a certain level of security must already be in place.
