Businesses are putting themselves at risk of cyberattacks — by recovering too fast
UK businesses are prioritizing post-attack recovery speed, and that's great, but they're missing out on some fundamental checks.
Report finds 74% of firms prioritize recovery speed over qualityBusinesses are torn on whose responsibility a recovery isDefining a 'Minimum Viable Company' helps identify what needs fixing first
New Cohesity research has revealed UK businesses could be putting themselves at risk of cyberattacks because they're prioritizing recovery speed over quality.
This applies to three in four (74%) UK organizations, according to the report, with nearly as many (70%) failing to even check that attackers have been fully removed from breached systems after a cyberattack.
Expenses back this up too, because three-quarters (76%) of the businesses surveyed admitted that cyber resilience investments focus too heavily on prevention rather than response and recovery.
Cybersecurity isn't focusing enough on effective recovery
Crucially, Cohesity's data shows that business leaders are virtually clueless about the state of their IT teams' readiness, with half (52%) of UK CEOs expecting basic business operations to resume within just 24 hours. A false sense of security could partly be why budgets aren't being directed to the right causes.
It's also clear that the responsibility for deciding which systems get restored first is still pretty uncertain – 23% say it should be on the entire board, 21% pin it on the CTO, 20% on the CEO and 14% on a security advisory board.
The report urges all organizations to consider their Minimum Viable Company (MVC) – the minimum combination of systems, processes and services that are deemed necessary for a business to carry on essential operations after an attack.
With a clear MVC, teams will be better placed to know which systems to prioritize. But at present, two in five (41%) don't even have their own definition of an MVC – on the flip side, not even one in five (17%) have a documented and tested definition.
"If you restore a system before verifying attacker access has genuinely been removed, you risk reinfecting yourself," UK&I VP Fraser Hutchison summarized.
Looking ahead, the next stages are pretty clear. Businesses need to define which systems are most fundamental to their core operations and who holds the responsibility of post-attack restoration.
