Why dealerships must prioritise cyber security

While the day-to-day operations of a dealership might vary greatly from other types of businesses, they all still have one thing in common: the need for cyber security. No matter what line of work they are in, every business needs to secure their data and do everything they can to prevent accidental leakage or malicious attacks. The threats to dealerships are pervasive. There are so many moving parts to keep track of (and we’re not just talking about the vehicles here). Dealerships have relationships with financial institutions, for lending purposes, and across the supply chain. They deal with a wealth of sensitive customer data such as contact details (names, addresses, dates of birth etc.), financial information, identity documents, and credit card data. Service schedules and loan processes are typically reliant on technology, as well as revenue or lead generating marketing activities.

When talking about cyber security, the nature of business for dealerships results in exposure to a wide range of cyber threats and risks. So, how can your dealership protect against cyber threats? Here is a few tips to get started:

Continuous preparation is a dealership’s best defence

Disruptive cyber-attacks, such as ransomware, can not only halt a dealership’s operations, but expose it to long lasting reputational impacts. Being unable to service customers will halt critical revenue generating business activities, and a breach of customer information will introduce significant reputational, legal and regulatory impacts.

The cyber landscape is constantly changing, and it is important to prioritise cyber investments accordingly. All companies, especially dealerships, need to continuously evolve to keep up. They don’t want anything suspicious touching their credit card transactions, supply chain relationships, and so on. Therefore, it’s important for dealerships to review cyber security measures that are in place and improve upon them as needed.

Develop and test an incident response plan

The time to prepare for an emergency isn’t during an emergency. Having a plan is essential, but it cannot be relied upon unless it’s been tested. There are two ways to do this – in a high-stakes real-world cyber-attack, or in a low-stakes, high-gain cyber exercise. Cyber exercises are also an effective way to communicate the non-technical impacts of cyber risk. For example, rehearsing your customer service, financial, operational, legal, media and communications responses to a cyber-attack can highlight the importance of cyber security for non-IT staff.

Establish resilience

An incident response plan will help you contain and eradicate the immediate impacts of a cyber-attack, however, a disaster recovery plan will help you sustain operations with manual work-arounds, and get back in business as soon as possible. A disaster recovery plan should outline a clear process to implement contingency workarounds, sustain operations, and communicate effectively when systems are down.

Offering ongoing education to all professionals

In addition to having documented plans for incidents and disasters, it’s also important to offer ongoing education to all employees. a dealership’s people represent its first and last lines of defence against cyber-attacks.

Cyber incident exercises for all employees

Beyond continuing education, employees must also be prepared for any scenario that may present itself. What is the best way to make sure they’re prepared? With realistic exercises. Practice makes perfect, and the more practice your employees have, the less vulnerable you’ll be to cyber threats.

Creating a culture of awareness and reporting 

Creating a culture within the dealership that not only makes employees aware of cyber security but also encourages them to report incidents will only help you. Cyber security shouldn’t just be a top priority among executives, make sure it’s a part of the culture within your organisation.

Understand your risk

To protect what’s important, you must understand which digital systems keep the business running, and how they’re vulnerable to cyber attack. This requires an understanding of which cyber adversaries are targeting you, what they’re targeting, and how they will target you. Establishing visibility of cyber risk starts with the tone at the top and requires an enterprise-wide approach

Adequate insurance coverage

No matter how confident you are in your security posture, your mindset should never be, “what will we do if a cyber incident occurs?” But rather, you should ask yourself, “what will we do when a cyber incident occurs?” Any business can fall victim to cyber threats, and because of that, it’s smart to have insurance. This can offset any financial losses that may happen because of a cyber attack.

Most dealerships don’t have people on staff that understand the current realities of what cyber risk is today. With an ever-evolving threat landscape, it is imperative that investments in cyber security are smart and pragmatic to protect your dealership.