The Fallacy of Despair: Why your security breach is not inevitable!

There is a growing sentiment within the business community that a security breach affecting their company is inevitable. This is perpetuated by security professionals and providers or services and products who reinforce this mythos with statements resembling:

“It’s not if your company is going to be breached but when your company is going to be breached.”

We do not subscribe to this philosophy of fear; this fallacy of despair. We do not accept the inevitability of anything even death because we are convinced that science will fix that unfortunate end. All that being said, it should come as no surprise that of course we do not agree that your security breach needs to be inevitable.

Fear is the creeping, crawling, insidious splinter of doubt germinating in your mind that compels you to react at times irrationally. Fear is a management tool to control the many or the one. Fear requires two opposing forces to synchronize.

Codependency has been defined as the addiction to people, behaviors or things. Codependency is the fallacy of trying to control interior feelings by controlling people, things and events externally*. The fallacy of despair is that there is nothing we can do to stop a bad thing from occurring.

Keep in mind that reactive cyber security firms want you to fear the unknown, the possibility that your company will be inevitably breached. It is in their business model’s best interest to keep your corporation codependent. They would not be in business if breaches were prevented.

While we have a moment of clarity without fear, consider that a security breach is comprised of. On one side of the equation you have an entity who desires access to your organization for some malicious purpose. On your side of this equation you do not want to allow this to happen; so don’t allow this to happen!

Do not volunteer to be a victim.

If a technologist creates something and another technologist can break that something, don’t you think it is safe to say that another technologist could identify the problem first and prevent the intrusion? Do not submit to this fallacy of despair!

In the cyber security realm there are only two forms of security; Proactive Cyber Security and Reactive Cyber Security. Reactive cyber security is all about cleaning up the mess post-breach. Proactive cyber security is all about preventing the mess from ever occurring.

The best and only thing that a company can do to remain ahead of threats by being proactive in the appropriate implementation of Governance, Technology and Vigilance (AKA The Security Trifecta). When about 96% of all breaches are avoidable through the application of simple and intermediate level controls, it is absolutely within your power to protect your company. Let me show you the way; away from this fallacy of despair philosophy.

Lazarus Alliance is Proactive Cyber Security.

*Wang, Charles R. Profound States of Despair: A Developmental and Systems Approach to Treating Emptiness. Boca Raton, FL: Universal, 2009. Print.

How do you quantify the true cost of a data breach? How do you measure the costs against the benefits of eliminating risks, mitigating risks or accepting risks to your business effectively?

The Lazarus Alliance executive leadership team has been the proverbial tip of the spear within the proactive cyber security realm well before there were actually corporate security departments and before the role of Chief Information Security Officer (CISO) entered our collective taxonomy.

It seemed only logical when you think like a futurist that our technological proliferation would only accelerate (it certainly has!) and that cyber security would predominantly factor into this equation (the understatement for the day!).

As with any analytical pursuit, the more data you have to analyze the better the outcome will be. Measuring the cost of a data breach is no exception to this rule. The cyber security industry and the practitioners within it now have ample data sets to draw from. The big task that remains is really a question (actually several but who is counting?) again and they are whether or not the security leadership within your organization has the:

1. The competency to do the job
2. The capability to do the job
3. The fortitude to do the job

Therein lies the wildcard. The human element once again is the weakest link in the chain between absolute cyber security and the lack thereof. It is important to point out that the first rule in the laws of security are that there is no such thing as absolute cyber security unless you cut the cord.

Now that we are at a place that resembles despair, let’s examine some facts that will help corporate leadership beginning with the Chief Executive Officer (CEO) down through the corporate ranks. It behooves us to distill the many facets of cyber security into the most obvious and most simplest of forms; proactive cyber security and reactive cyber security.

Reactive Cyber Security

By definition, reactive cyber security is when it’s too late for preventive measures. You company is in the news and on the next industry breach report. The CEO, CIO and CISO are most likely going to be on the head chopping block. If your company survives, there will be huge litigation costs and long term reputation damage that is almost impossible to quantify.

Depending on what breach statistical report you choose, on average the cost of a singular human database record is $205 USD. Using some very complex mathematics (A*B=C) we can estimate the costs of a data breach which will help us make decisions on how to be proactive in the pursuit of risk elimination to our organizations.

For example, recently published on CNN was “Government investigators now believe that the data theft from the Office of Personnel Management computer systems compromised sensitive personal information, including Social Security numbers, of roughly 21.5 million people from both inside and outside the government, the government announced Thursday.”

Let’s do the math!

$205.00 multiplied by 21,500,000 records equals the estimated cost of the Office of Personnel Management data breach is going to be $4,407,500,000.00! (Expletives omitted at this point!)

What are some additional ancillary costs of this breach:

1. The Office of Personnel Management will never be trusted again
2. The CIO and CISO should lose their jobs in utter disgrace due to their egregious negligence
3. The US taxpayers will be strapped with the costs for decades

We have some eye popping and sleep losing facts to take away from this data that we can apply to the organizations we are responsible for. You should have a reasonable idea of how many records you are the custodian of so use this information to calculate another mathematical decision making tool; annualized loss expectancy (ALE).

ALE is an integral part of a proactive risk assessment so lets move on to proactive measures; more on ALE in a moment.

Proactive Cyber Security

By definition, proactive cyber security is all about preventing a data breach through the effective and appropriate implementation of controls and countermeasures. It’s all about keeping your company out of the news and off those industry breach reports.

Think about what it costs to have a third part risk assessment or compliance audit. From a holistic perspective it is trivial when compared to the cost of a data breach. The numbers don’t lie. Taking a proactive approach to cyber security is far less expensive on order of magnitudes. What we are finding is that the cost on average to proactively address security, risk, audit and governance is less than the cost of a single CISO level employee!

To quote William Ochs, a partner in the Lazarus Alliance GRC practice, “With every successive breach we continue to see that organizations miss the adage that an ounce of prevention is worth a pound of cure. It seems that in the complexity of cyber security, the most common sense proactive steps are ignored and we keep paying by the pound.”

The best place to begin is with an IT Risk Assessment. Properly conducted, and surveys indicate that 59% of all organizations do not, would eliminate most threats to the business. Quite specifically when you analyze the big breaches over the past 12 months you will find that 100% are attributed to human hacking and 96% could have been prevented by implementing simple and medium grade controls. All of these are easily identified through a proper risk assessment.

Part of every risk assessment includes calculating costs and expenses to eliminate risks which is finally where ALE comes in. While ALE was originally meant for accountants only, the executive leadership of Lazarus Alliance discovered that it made perfect sense for cost center lines of business like cyber security.

To provide a brief explanation of how it is calculated, there are two factors that comprise the ALE. They are the Single Loss Expectancy (SLE), which is the percentage of the asset you are attempting to protect that would be lost in a single exposure, and the Annualized Rate of Occurrence (ARO), which is the frequency the loss event occurs in a year. Those two factors multiplied together give you’re the ALE (ALE = SLE * ARO).

For example, suppose than an asset is valued at $200,000 and the single cost of exposure is $50,000. Your SLE is now defined as $50,000 right? How many times in a year do we expect this exposure event to occur in a year? If we expect an exposure to occur once every year, then ARO is 100% whereas if we think there is a 50/50 shot, our ARO is now 50% right? For discussion purposes, let’s suggest we think there is a 50/50 chance an exposure might occur so our ARO is .5. With our SLE equaling $50,000, multiplied by our ARO of .5, the ALE is $25,000.

If you were to spend more than $25,000 for risk mitigation or avoidance by purchasing some security product, insurance or some legal service, you are spending too much. You are most certainly spending too much if the product or service you deploy does not eliminate the risk. If spending $25,000 does not set your ARO to zero, but say, cuts the risk down by 75% instead, you should reduce that $25,000 mitigation expense by 25% to bring everything back into a cost-effective risk avoidance measure.

We have explored the wildly different costs between proactive cyber security and reactive cyber security. Companies can no longer afford to go-it-alone when the stakes are so high. It’s not enough for the government or the private sector to enact rules and regulations; you need qualified assistance to make it happen.

Lazarus Alliance is Proactive Cyber Security®

Cyber Attack: United Airlines, WSJ, NYSE … Oh My!!

While United Airlines grounded their entire fleet and the Wall Street Journal was off-line and the New York Stock Exchange could not conduct trading yesterday for an extended period of time, they all have stated that they were not under a cyber attack.

We do not believe in coincidences!

Apparently we are not alone with this cyber attack sentiment. The Phoenix Business Journal conducted an engaging cyber attack conversation with us about it.

Computer network problems and outages brought the New York Stock Exchange to a halt, temporarily grounded United Airlines flights and took down The Wall Street Journal’s website Wednesday.

While none of the affected businesses blamed the problems on cyber attack by Russian, North Korean, Chinese or ISIS hackers, their troubles show the vulnerability and potential minefields for U.S. computer and communications networks.

Businesses, large and small, as well as consumers are dependent on communications systems and computer networks in their day-to-day lives.
If technical glitches can halt NYSE trading on Wall Street and force United to ground and delay flights, think of what they can do to Main Street businesses, startups and personal lives.

United Airlines’ troubles adversely impacted a couple dozen flights at Phoenix Sky Harbor International Airport today, according to FlightAware.com. Chicago, New York, Atlanta and Los Angeles had major delays.

A cyber security expert suspects today’s problems may stem from malware contracted from a third-party vendor rather than from nefarious hackers invading U.S. business systems from a dark room in Moscow, Pyongyang or Shanghai. “If you look at all the cyber attacks in the last 12 months, 100 percent of their breaches happened due to human interaction on third party networks,” said Michael Peters, CEO of Lazarus Alliance, a cyber security company:. “Employees of a third party company will download malware and forward it to a company, allowing cyber attacks.”

United officials blamed router problems on their network problems. “An attack can certainly happen through a router,” said Peters. “A router isn’t any different from network devices, they follow all the same rules. So a cyber attack can happen when a router is hacked and traffic is rerouted.”
Peters explained that routers are like highways, controlling network traffic. When cyber attacks happen, hackers can “reroute” traffic and effectively send data to other locations where it can be forwarded to another location.

Peters said most companies who are hacked, even large organizations, don’t have proactive measures in place, leaving them vulnerable.