Information Security: The Power to Keep Your Business Running Smoothly and Efficiently

(Dan Tri) - According to experts, it is necessary to recognize that the ultimate goal of information security is not how many vulnerabilities can be handled or how many attacks can be prevented, but rather to ensure continuity and efficiency for the business and production activities of the enterprise.

Changes in thinking about information security were shared at the CIO CSO 2024 conference. This is considered a landmark message, showing major changes in the information security situation globally and in Vietnam when no business or organization can be sure of its safety.

Information security is not a choice but a necessity

Opening the event, a representative of the Department of Information Security, Ministry of Information and Communications, affirmed that implementing information security regulations is now not a choice but a must.

The warning was issued in the context that information security regulations are complete, but many businesses and organizations are still subjective and not best prepared to respond to risks.

On the other hand, cyber criminals are increasingly active and have considered Vietnam a market. In fact, there are large domestic units that have been attacked, causing losses of millions of USD, and many other units have been fined for non-compliance.

To clarify this issue, Mr. Nguyen Son Hai, Director of Viettel Cyber Security (VCS) spoke about the reality of the expansion of cybercrime targets. Large enterprises with strong financial potential are no longer the only priority of hackers because they have some defensive capabilities. Hackers have now expanded their targeting to "soft targets" which are smaller enterprises that do not focus on information security. At that time, they will attack on a large scale to maximize profits. This makes any enterprise a target of hacker groups with world-class skills.

An toàn thông tin: Sức mạnh để doanh nghiệp hoạt động liên tục và hiệu quả - 1 — The latest developments and information security situations are shared at CIO CSO 2024 (Photo: Organizing Committee).

VCS representative assessed that attacks are now not only to steal data and assets, but also to disrupt business operations. Typically, data encryption attacks (ransomware) combined with APT targeted attacks, encrypting at least 10 TB of data, causing domestic businesses to pay more than 5 million USD, and at the same time seriously affecting their reputation and assets, not to mention dozens of businesses that have been initially compromised.

While the attackers are active, businesses face many challenges when implementing information security. From this asymmetry, Mr. Hai believes that the possibility of being attacked by cyber attacks has become an inevitable objective reality, requiring businesses to have a new approach.

"Previously, we tried to prevent the attack, but now we have to assume what would happen if the attack was successful. We need a solution to cover it, which is to optimize for cyber resilience, with the ultimate goal of maintaining continuous operations for organizations and businesses," said Mr. Hai.

Investing in information security ensures continuous business performance

Through the actual implementation process for hundreds of domestic units, the Director of VCS sympathizes with the challenges that IT and information security leaders often face. At that time, the three major issues that need to be solved are human resources, investment efficiency, and cost optimization.

An toàn thông tin: Sức mạnh để doanh nghiệp hoạt động liên tục và hiệu quả - 2 — Discussion session between senior leaders on cybersecurity strategy transformation at CIO CSO 2024 (Photo: Organizing Committee).

When information security human resources are always in short supply, good personnel are often only available to 5% of large companies. The advice given by VCS experts is to combine training of existing personnel and working with partners to supplement resources, building a 24/7 monitoring team.

Regarding investment efficiency, Mr. Hai suggested that units need to measure by outcome indicators instead of just the output of the investment. "Previously, the goal was to prevent how many incidents and attacks. But now the ultimate goal is to ensure business continuity," Mr. Hai emphasized.

Finally, according to VCS leaders, to optimize costs, in addition to changing the way of doing things in a consistent direction, they need to find suitable partners to increase specialization and avoid spreading investments.

An information security partner for a business can be a product provider or an information security service provider. However, when acting alone, these partners often cannot provide a comprehensive strategy, do not have a deep understanding of the organization, and even the costs for these partners can be inflated and difficult to control.

This is also the reason why, over the past two years, VCS has developed the Cyber Security Maturity Program (CSMP), aiming to become a long-term partner by establishing management and measurement indicators, while controlling and optimizing costs, following the life cycle of the business to help the business mature in information security, ensuring effective and continuous operations.