1.7 Organizational Implications of Cybersecurity★

# Three Questions the Morning After

• Your company's customer data leaks overnight.
• Next morning the boss asks: who should have stopped this? What will it cost?
• And what do we tell customers, and the regulator?
• Suddenly cyber security is everyone's problem, not just the IT team's.

# Who Handles IT Security PYQ 1M

IT security in an organisation is maintained and handled by IT security engineers working in the IT security team, led by the Chief Information Security Officer (CISO).

Roles in the security team

1. CISO: the senior manager responsible for security strategy, budget and reporting to top management.
2. Security engineer / architect: designs and builds secure systems, firewalls and access controls.
3. Security analyst: watches alerts and investigates suspicious activity, usually in the SOC (security operations centre, a team that monitors 24 × 7).
4. Security administrator: manages day-to-day settings: user accounts, firewall rules, antivirus.
5. Incident response team: acts when an attack happens: contains it, fixes it, restores systems.
6. Auditor: checks independently that controls work and rules are followed (→ 4.7).

• Everyone else has a part: top management funds and supports security; every employee follows the policy.

flowchart TD
    M["<b>Top management</b><br>(board, CEO)"]:::blue --> C["<b>CISO</b>"]:::blue
    C --> E["<b>Security engineers</b><br>(design, build)"]:::green
    C --> O["<b>SOC analysts</b><br>(monitor 24 × 7)"]:::green
    O --> I["<b>Incident response</b><br>team"]:::amber
    classDef blue fill:#5b84d424,stroke:#5b84d480
    classDef green fill:#52a86e24,stroke:#52a86e80
    classDef amber fill:#d6a24424,stroke:#d6a24480

# Organizational Implications of Cybersecurity

Impact of a breach on the organisation

1. Financial loss: stolen money, ransom, investigation and recovery costs.
2. Downtime: systems offline mean lost sales and idle staff.
3. Reputation and trust: customers move to competitors; share prices can fall.
4. Legal and regulatory penalties: under the DPDP Act 2023, fines can reach ₹250 crore; CERT-In must be told of specified incidents within 6 hours.
5. Loss of intellectual property: designs, source code and plans stolen by competitors.

Security cost vs breach cost

• Spending on prevention (tools, staff, training) is almost always cheaper than paying for a breach.
• Security is also a business enabler: clients trust a secure company, many contracts require ISO 27001, and safe systems let the business go digital with confidence.

Policies, standards and compliance

• A written security policy sets the rules for everyone (→ 4.8).
• Standards such as ISO 27001 give a proven framework (→ 4.10).
• Laws and regulators: IT Act 2000 (→ 5.5), DPDP Act 2023, RBI rules for banks.

People, process and technology

• Security needs all three together (→ defence in depth, 1.1).
• Awareness training and security culture: staff who report a suspicious email instead of hiding a mistake.

BYOD and remote work

• BYOD (bring your own device): staff use personal phones and laptops for work.
• Risks: lost or stolen devices · unsafe home Wi-Fi · personal apps mixed with company data.
• Controls: mobile device management (MDM) · VPN · MFA · separate work profiles · remote wipe.

Incident response and business continuity

flowchart TD
    A["<b>Prepare</b><br>(plan, team, tools)"]:::blue --> B["<b>Detect and analyse</b>"]:::amber
    B --> C["<b>Contain</b><br>(stop the spread)"]:::amber
    C --> D["<b>Eradicate</b><br>(remove the cause)"]:::green
    D --> E["<b>Recover</b><br>(restore systems)"]:::green
    E --> F["<b>Lessons learned</b>"]:::blue
    classDef blue fill:#5b84d424,stroke:#5b84d480
    classDef amber fill:#d6a24424,stroke:#d6a24480
    classDef green fill:#52a86e24,stroke:#52a86e80

• Incident response plan: the steps above, decided in advance, so no time is lost during an attack.
• Business continuity plan (BCP): how critical work continues during a disruption (backup sites, manual procedures).
• Disaster recovery (DR): how IT systems and data are restored from backups (→ 4.11).