All Companies Are At Risk of a Breach; Have a Security Strategy In Place for Prevention

The cost to companies due to a data breach can be very significant. In fact, more often these days they are even bankrupting small and medium sized businesses. No industry type or organization size is immune. The CIA and NSA have even been outed recently by hackers who exposed not only data they stole from these organizations, but also the cyber tools they use. It’s easy to just throw up our hands and believe that even Obi Wan Kenobi cannot help. However, there are ways to mitigate the risk.

Unfortunately, cybercrime does exist and for various reasons. It could be for fame and acknowledgement, could be to gather information to perpetrate other crimes, or could be to make a buck. In fact, most cybercrimes likely are motivated by the potentially significant financial gain. Whatever the goal, there are multiple tools that the “black hats” use and they all generally start with a phishing attack.

Phishing uses social engineering and psychology to convince potential victims to click a link or open an attachment in email or otherwise disclose information that can be used for another purpose. Those purposes could be to get malware onto a network that opens a back door in or to install ransomware, among many others. Phishing is as successful as it is in large part because humans are naturally curious and trusting. By taking advantage of these realities and creating even a somewhat plausible email, will generally net the criminal a big payday.

Ransomware has been emboldened by the recent creation of Bitcoin and other cyber currencies. These are very difficult to trace, making it a preferred payment type for hackers. And because the data on a network is usually very important to a business, they sometimes get away with a large sum.

At one point, it was reported that hundreds of thousands of laptops are left at airport TSA checkpoints each year. Whether or not that number is still valid, it does still happen. Many are also stolen. With the amount of data stored on these and other mobile devices, theft, or loss of them can cause a lot of grief for companies.

While financial losses can be measured in investigative, notification, and litigation cost, it is nearly impossible to determine loss of business or damage to reputation due to a data breach.

Target paid millions to settle a class action lawsuit after a breach in 2013. It also reported $61 million in losses on its earnings reports. However, the number associated with litigation, fraud claims, and investigations is not known. Security company Gemalto surveyed 4,500 adults and found that 65% of respondents would never or are very unlikely to do business with or shop at a company that had financial data stolen via a data breach.

Companies do have a responsibility to protect data. It may be customer information, financial information, or “merely” employee data. W-2 and other business email compromise (BEC) types of crimes are increasing year over year. The FBI reported that losses to victims due to this totaled nearly $3.5 billion in the last half of 2016 alone. A Proofpoint study found that 80% of respondents to a survey reported at least one BEC attack within the 30-day period prior to participation in the study.

In 2015, courts affirmed the Federal Trade Commission’s (FTC) authority to hold companies responsible for the loss of data and the harm caused to consumers if they do not follow cybersecurity practices that reasonably protect data. States are also on board and 47 states and the District of Columbia have legislation on the books regarding data breach reporting and notification.

Employers need to re-evaluate their cybersecurity strategies to ensure it is covering at least these three basic areas:

2

2

2

Technical tools should be implemented such as firewalls, anti-malware, and anti-virus solutions, as well as web filtering products. In addition, all systems should be patched and updated regularly and immediately with critical and security related patches. Implementation and enforcement of a strong password policy is also necessary.

Training and awareness are essential to any organization, regardless of size. A Pew Research study recently found that only 54% of respondents knew how to properly identify a phishing attack. Unfortunately, phishing is the number one way that cybercriminals find their way into networks. This is why a thorough and continual training and awareness program is no longer optional.

Cyber insurance is becoming more of a necessity in the same way as general liability insurance. After all it is no longer IF an organization will be breached, but when. This coverage is being marketed more aggressively of late and is worth taking a look. It can cover costs of investigations, litigation, and notification costs depending on the policy. Target had a policy in place that paid out $44 million after its breach in 2015. While it didn’t cover nearly all the estimated costs for that, no one can deny that it did help.

It’s worth the time to develop a cybersecurity strategy for any sized organization. For assistance and guidelines, check out Framework for Improving Critical Infrastructure Cybersecurity from the National Institute of Standards and Technology (NIST). It “focuses on using business drivers to guide cybersecurity activities and considering cybersecurity risks as part of the organization’s risk management processes” and can act as a start to or review of a good cybersecurity strategy.