By Brian Tray
A cyber breach means loss of revenue, not to mention credibility and private data. Mitigate risk and protect valuable data with a top-level evaluation of your company’s security risks.
“Do we really need a formal Risk Assessment? My IT people tell me we’re protected…”
That’s the most common reaction we hear when we speak with business owners, executives, and managers about cybersecurity Risk Assessments.
It’s time to stop thinking about cyber security as separate and distinct from your business operations. Security is just as important as your bank accounts, financial controls, business insurance, customer satisfaction, and workplace safety. It’s a core part of doing business, and therefore it must be built into the fabric of your organization it is also very important to read more about nerc compliance to learn how to comply.
Smart Auditing Reduces Network Risk
Security is about managing risk, not eliminating it. While it’s impossible to completely eliminate network risk, you can make strides to greatly reduce it. Therein lies the “Why?” of performing a Risk Assessment: you need it to understand your company’s cyber risks and how to manage them to be as protected as possible.
A Risk Assessment scrutinizes what IT assets you have, what data you’re storing, which applications you’re using, and identifies the risks associated with each of these categories for your business. When we talk about risk to your business, we mean your bottom-line dollars and your chance of losing them.
A risk assessment from a Cyber Security Company produces a bird’s-eye view of your cyber security risks, and this insight can be used to make informed decisions about which weakness to tackle first that will make the most impact. An assessment provides you with a dashboard for taking focused action to reduce your cyber security risk over time. It acts as a springboard for continual identification of threats and vulnerabilities.
Cyber Threats Change Daily. Are You Up-to-Date?
Proactive ultimately costs less than reactive. The Risk Assessment is a living and evolving process that is continually updated and improved to meet the ever-changing threat landscape of cybercrime. There are daily updates of new ways the cyber criminals exploit our networks, hardware, data, software applications, Internet and people to gain access to any lucrative resource.
Here’s an important question to answer: Can your organization defend itself against a silent, patient, skilled, and determined cybersecurity criminal? By being prepared, knowing your risks and focusing your efforts on reducing them, you can effectively protect your company.
In fact, most insurance companies offering cyber liability coverage will now require a cybersecurity risk assessment, and they’ll want to know your risk posture to underwrite and price your policy premiums. The more control you can demonstrate over your cyber risk, the better your position to negotiate coverage and premiums.
The True Cost of a Security Breach is Substantial
We all know that a cyber breach can shut down all or some business operations. Loss of business data can mean the loss of a competitive advantage. Loss of customer data can mean state and federal fines, loss of customer trust, legal costs, litigation expenses and possible liability of the executives and board members for failing to take reasonable and industry- expected steps to protect the business and its customers. The cost of remedying a cybersecurity breach is rumored to be three times greater than the cost of preventing one!
One report found that small to mid-sized businesses are the most vulnerable to cyber attacks and that one successful cyber attack, be it a data breach or a (more recently popular) ransomware, can shut those businesses down completely.
The real costs of addressing a cyber attack can be staggering. Consider these examples of costs following a successful hack or cyber-attack:
Retailer with $30 million in revenue, faced with the compromise of 50,000 credit card accounts. The cost of incident investigation, customer notifications and crisis management, class action lawsuit and Payment Card Industry (PCI) related costs – exceeded $2,550,000
Non-profit hospital with $100 million in revenue suffered the theft of 550 patient healthcare data (PHI)., The cost of the incident investigation, customer notifications and crisis management, fines and penalties exceeded $380,000. Consider, it is estimated that an average healthcare breach impacts 28,000 records – total resulting cost climbs to over $3,000,000.
A community bank with $350 million in assets experienced a cyber-attack that shuts down its operations for three days. The cost of the incident investigation, customer notifications and crisis management, fines and penalties – nearly $800,000, not to mention loss of business income for at least three days.
Software provider of HR and membership management for gyms nationwide suffered a breach that exposed all employee and customer personal data. The cost of the incident investigation, customer notification and crisis management, fines and penalties exceeded $1,340,000.
Manufacturer with 400 employees suffered a breach resulting in 298 past and current employees subsequently falling victim to IRS fraud. The cost of incident investigation, customer notifications and crisis management, fines and penalties – exceeded $200,000. Manufacturers that use CNC plasma software should also be wary of hackers since they could cause damage or disruption, hijack a machine, or steal valuable intellectual property.
Choosing a Cybersecurity Assessment Process That’s Right
Establishing a baseline position of your IT assets and then a target position on the risk scale makes it easier to establish a clear plan for how to get from one point to the other. VIMRO uses our exclusive Risk Assessment and, subsequently, the application of the NIST framework to establish a baseline and target position, with the end goal of arming you with the knowledge to invest your money and time in a way that effectively and efficiently reduces your cyber risks. The industry and government-developed principles and best practices which created the NIST framework are not, however, a one-size-fits-all approach for every company in every industry.
Your company is unique, and the threats, vulnerabilities and risk tolerances are unique to you as the business owner, executive or manager. It’s crucial to apply these principles and ensure that your organization’s cybersecurity program addresses only what it needs to address for your business operations and applicable cyber related risks.
In closing, it’s important to remember that cyber breaches are inevitable. But you can take preventative measures to ensure that you’re prepared and minimize the damage before it happens. All it takes is a bit of common sense and a willingness to keep your company protected, no matter what.
For a deeper dive into VIMRO methodologies and applications of the framework components, please read The Demystification of Successful Cyber Security and Cyber Security Audits and Risk Management 2016.
