We refer here to the theft of information for industrial and commercial espionage, fraud and extortion (ransomware) and sabotage for terrorist or demonstration purposes.

This peak of the accident, measured in every international report that deals with the subject (for Italy the Clusit Report), first got the attention of the press and the media: there are countless articles also in the generalistic newspapers that deal with the accidents of cybersecurity and, then, of the national legislator and and everyone who has introduced rules, laws and internationals that oblige companies and companies of this type to take appropriate security measures, organizational guarantees and security guarantees of third parties (citizens, the market, customers, patients etc.).

It is now common opinion that these measures will be proportional and commensurate with the risk. Modern laws do not take a specific list of things to do, but writes that appropriate measures are taken according to these analyzes, refer to international best practices and require the company or organization to be accountable and can understand their degree of empowerment.

At the same time it is now obvious to all professionals that absolute safety does not exist and that a greater investment in safety only increases the degree of safety up to a certain point. It is therefore all the more necessary to start an investment in safety starting from an initial assessment and risk analysis and then determine which is the most useful level of investment in the specific business context and decline it over time.

The resulting crisis combines cybersecurity, risk and compliance. A mature approach to the problem considering these aspects together. The purpose of initiatives in this area must be to create an organization capable of guaranteeing the right level of confidentiality, integrity and availability of information, and, more importantly, being able to survive the inevitable cyber security incidents that will occur.
So be resilient!