With Sumit Bhatia & Randy Purse of Rogers Cyber Secure Catalyst, one of our Innovation District partners!
Running a start-up in its early days is a whirlwind, and securing that early capital to ensure you can build your MVP involves long days. You have a great team behind you, you are focused on raising the big dollars so you can build the best product possible for your target market, and you know your timing is right, but then an investor through their due diligence asks you about your privacy and security posture…
Even the most technically savvy founders can have a blind spot around cybersecurity. It is often a result of security being seen as a cost centre or as something that can be addressed at a later stage in the evolution of the company. But, it has been a crucial stage for investor due diligence, and a bad data breach could lead to a big loss of trust with early adopters.
Cybersecurity for start-ups is not just an add-on, but it’s an integral part of how you build your product and the way you collect data. Your first step as a start-up should be assessing how cybersecurity is integrated into your organization and development processes. What does your development lifecycle look like? Does your development team embed security into their work? Are you thinking about Application and API security? How are you working with partners and suppliers to support supply chain security?
You have so much on the line including your reputation and the investments you and others have made. Have you assessed your cyber risk as a strategic and operational risk? How are you managing these risks? Are you familiar with the compliance and regulatory frameworks surrounding your industry? Do you understand the new privacy and security laws in Canada and those of the other regions you plan to operate in?
Yes, there are a lot of questions to ensure a resilient cybersecurity posture, some of which you may have answers to and others which may not have yet crossed your mind. The reality is that you are seen as responsible for protecting yourself, your investors and your customers from the wide variety of cyber threats that can have impacts from a simple annoyance to catastrophic business loss.
It’s an unfortunate reality that most start-ups don’t think about cyber risk in the same way that they consider the market or financial risk. Yet they are inherently tied together. If you don’t prepare for, prevent and have the ability to effectively respond to cyber threats, everything you worked for can vanish in a moment or at minimum cause a lot of distress, operational instability and loss of business. Whether it’s a virus, ransomware, or a hack that steals your intellectual property, start-ups are continuously at risk and should ensure that they have at least basic cybersecurity processes and protections in place.
8 Recommendations for Start-up Cybersecurity
1. Understand why security and privacy matter to your different stakeholders
There’s a lot on the line and whether they are clients, investors or customers. And you have an obligation to protect their interests. Ensure that you have a comprehensive understanding of not only local regulatory compliance requirements but other risks that may drive your information security requirements.
2. Establish cybersecurity governance
Ensure that someone is assigned to lead cybersecurity and has responsibility for the implementation of a cybersecurity program to prevent and protect your organization from cyber threats. While some knowledge of IT is good, they need not be technically savvy. It’s more important that they understand the organization and its priorities. Technical expertise when required can come from a wide range of sources.
3. Create and maintain an asset inventory
Know what assets you have, where they are, and how they are protected. This includes data, software and systems. Understand that the asset may have tangible or intangible value and, along with this value, consider the requirement for confidentiality, integrity and availability of those assets.
4. Assess your risks and document them
With the asset inventory, you are in a position to identify the assets that are critical to your organization and assess the risk. Once the risk is assessed, you can better determine where to invest in cybersecurity which will help you ensure risk remains at an acceptable level.
5. Implement cybersecurity baseline controls
While the types of cybersecurity controls you should implement are based on your risks and your business, threat and technical context, the Canadian Centre for Cybersecurity suggests that all small and medium organizations implement 13 different controls that will help generally manage your cyber risk. Not all of these will necessarily have the same priority for implementation, so if in doubt, consult a trusted cybersecurity professional to help with this decision.
6. Create a cybersecurity culture at your Start-up
From the start, you have the advantage to influence positive behaviours within your organization by ensuring that everyone knows their responsibility to protect the organization and its assets from cyber threats. Implementing a security awareness and training program will help, but it needs reinforcement by leadership that takes cybersecurity seriously. Once you have a cybersecurity culture in place, a majority of your worries are over as many of the incidents that occur are the result of individuals either not knowing what to do or not doing the right thing when faced with a cyber threat.
7. Integrate security into your development lifecycle
As a start-up, there is little doubt that you have already considered how you are going to leverage technology to position your company within the digital economy. Doing so safely and securely is the key. As you consider your use of digital technologies, consider your compliance requirements and cyber risks upfront.
Then embed your security requirements into the design and development processes rather than waiting until the end of the process. Beyond this, make sure that processes are in place to sustain security through business, threat and technical changes. If necessary, engage third-party cybersecurity providers or consultants to assist you.
8. Plan for growth
The plan for most start-ups is growth. This means that you’ll need to stay on top of your cyber risks as you grow your organization and ensure that the people, the processes, and the technology are in place to continue to prevent and protect it from cyber threats.
This may include increased investment in security infrastructure, expansion of technical and non-technical cybersecurity controls or provision of role-based training to gain cybersecurity expertise. The goal would be to ensure that your cybersecurity program keeps pace with your growth and other changes that influence your market.
Get Started
Part of the excitement of a new venture is your clean slate. Right from the start, you should form deep insights into all aspects of your business. Cybersecurity should be included in your overall organizational strategy, product roadmap, technology infrastructure and corporate culture without having to undo what already exists, and you can plan and invest based on anticipated growth.
The key is to act while you still have these advantages and your risks are relatively lower. The longer you delay in implementing a cybersecurity strategy, the more risk you incur and the more effort and investment that will be required.
Yes, it increases organizational effort and will require some additional capital. But consider this as an investment in the future of your company because without it you may not have a business if you suffer a significant cyber attack.
Take your Company to the Next Level
Looking to launch the North American headquarters of your Start-up, and access over 60% of the world’s GDP through Free Trade Agreements? Canada’s Start-up Visa program helps international entrepreneurs and their families join the #InnovationNation. Our Start-up Visa Incubation program is designed to help you prepare for international expansion before you even arrive, and gives you office space in the bustling Brampton Innovation District. Apply Today!
Sumit Bhatia is the Director of Innovation and Policy at the Rogers Cybersecure Catalyst and leads the Catalysts’ work on the Catalyst Cyber Accelerator, Cybersecure Policy Exchange and their SMB initiatives.
Randy Purse is Senior Cybersecurity Advisor at the Catalyst and works with the Catalyst Cyber Range and their corporate training initiatives to create and deliver new, innovative programs. To learn more about the Rogers Cybersecure Catalyst, please visit www.cybersecurecatalyst.ca