Businesses are putting themselves at risk of cyberattacks — by recovering too fast

Report finds 74% of firms prioritize recovery speed over quality Businesses are torn on whose responsibility a recovery is Defining a 'Minimum Viable Company' helps identify what needs fixing first New Cohesity research has revealed UK businesses could be putting themselves at risk of cyberattacks b

<![CDATA[ <article> <ul><li><strong>Report finds 74% of firms prioritize recovery speed over quality</strong></li><li><strong>Businesses are torn on whose responsibility a recovery is</strong></li><li><strong>Defining a 'Minimum Viable Company' helps identify what needs fixing first</strong></li></ul><p>New Cohesity research has revealed UK businesses could be putting themselves at risk of cyberattacks because they're prioritizing recovery speed over quality.</p><p>This applies to three in four (74%) UK organizations, according to the report, with nearly as many (70%) failing to even check that attackers have been fully removed from breached systems after a cyberattack.</p><p>Expenses back this up too, because three-quarters (76%) of the businesses surveyed admitted that cyber resilience investments focus too heavily on prevention rather than response and recovery.</p><h2 id="cybersecurity-isn-39-t-focusing-enough-on-effective-recovery">Cybersecurity isn't focusing enough on effective recovery</h2><p>Crucially, Cohesity's data shows that business leaders are virtually clueless about the state of their IT teams' readiness, with half (52%) of UK CEOs expecting basic business operations to resume within just 24 hours. A false sense of security could partly be why budgets aren't being directed to the right causes.</p><p>It's also clear that the responsibility for deciding which systems get restored first is still pretty uncertain – 23% say it should be on the entire board, 21% pin it on the CTO, 20% on the CEO and 14% on a security advisory board.</p><p>The report urges all organizations to consider their Minimum Viable Company (MVC) – the minimum combination of systems, processes and services that are deemed necessary for a business to carry on essential operations after an attack.</p><p>With a clear MVC, teams will be better placed to know which systems to prioritize. But at present, two in five (41%) don't even have their own definition of an MVC – on the flip side, not even one in five (17%) have a documented and tested definition.</p><p>"If you restore a system before verifying attacker access has genuinely been removed, you risk reinfecting yourself," UK&amp;I VP Fraser Hutchison summarized.</p><p>Looking ahead, the next stages are pretty clear. Businesses need to define which systems are most fundamental to their core operations and who holds the responsibility of post-attack restoration.</p><figure class="van-image-figure pull-right inline-layout" data-bordeaux-image-check="" ><div class='image-full-width-wrapper'><div class='image-widthsetter' style="max-width:676px;"><p class="vanilla-image-block" style="padding-top:31.51%;"><img id="diM9tpwF2Lz85R8q85CT78" name="tr-g_news" alt="Google logo on a black background next to text reading 'Click to follow TechRadar'" src="https://cdn.mos.cms.futurecdn.net/diM9tpwF2Lz85R8q85CT78-1920-80.jpg" mos="" align="right" fullscreen="" width="676" height="213" attribution="" endorsement="" class="pull-rightinline" /></p></div></div></figure> </article> ]]>