“Geopolitical risk is only going to get worse,” said Renee Murphy, principal analyst with Forrester during the research and advisory company’s Security & Risk Forum 2022 on Nov. 8. Murphy and Forrester analyst Allie Mellen outlined strategies for companies to face the realities of geopolitical risk and emerge as trusted leaders.
In the 1990s, Murphy worked as a network engineer for a dot-com company. Cybersecurity, third-party risk, and state-sponsored attacks were largely unthought of, but today, the reality is very different. A global pandemic and the war in Ukraine are just two events shaping the geopolitical and security landscape that companies must operate in now. CISOs and security teams are tasked with building operational resilience as their companies move forward into an uncertain future, but how?
“Geopolitical events are going to happen whether or not you are ready for them,” said Mellen. “But if you are ready for them, you're going to be able to take these very challenging, very difficult situations, these big lemons, and turn them into lemonade by turning them into enterprise-wide moments of leadership for you and for your team.”
Understand the Adversaries
Who are your organization’s adversaries? If you don’t know the threats, how can you defend your organization?
“Create a list of trusted geopolitical resources that understand geopolitical risk and understand it well,” Mellen recommended.
She also suggested gathering up-to-date threat intelligence from vendors that offers insight into risks specific to a company’s industry, size, and regions of operation. Security teams can also leverage governments as their allies. Establishing government contacts across an organization’s footprint and following governmental advisories can help security teams understand the adversaries they face.
External adversaries aren’t the only threats to consider. Multinational organizations must make decisions based on their values, but not all employees may agree with a decision, like pulling operations from a certain country, coming from headquarters. A company’s response to geopolitical incidents opens the door to insider threats.
Prepare for Geopolitical Risk Now
Geopolitical risk is inevitable. Yet, it can be easy for companies to ignore. Maybe all attacks to date have been minimal, or an organization has thus far been unscathed. But each risk a company deems acceptable adds up.
“When something [could have] a catastrophic impact, but has a tiny chance of coming true, it still has a catastrophic impact. It is not a low risk,” Murphy pointed out.
Business continuity planning is essential right now. Crises rarely happen -- and they do happen -- as you plan. “Instead of preparing for exactly, specifically what's going to happen, rehearse your disaster recovery plans and business continuity plans at a technical level,” said Mellen.
This means securing buy-in not just with the security team but across the entire organization. Forming a cross-functional crisis management team can help build the resilience companies need to manage through geopolitical incidents.
Establish Trust
Organizations that want to be leaders in today’s world need the trust of their customers, their employees, and their partners.
“Focus on the low-hanging fruit early on [such as] privileged accounts, device hygiene, enforcing strong passwords, and in the longer term, leverage a zero-trust strategy to protect devices, protect users, protect networks,” Mellen emphasized. “What's most important is that through this you show complete transparency, empathy, and communication."
What to Read Next:
‘Trust’ Must Guide Cyber Risk Management During Geopolitical Incidents
Cloud, Data, and Political Protests Mark the 2022 AWS Summit