Defeating Cybersecurity Deficits with a 1-2 Punch

Steve Morgan, a professional acquaintance who writes about cybersecurity for Forbes, published One Million Cybersecurity Job Openings In 2016 and revealed some jaw-dropping statistics concerning the growing deficit in hiring qualified cybersecurity employees. To make matters worse, this chasm is exacerbated by the explosion of corporate breaches impacting and even decimating businesses in financials, education, business, government, and especially healthcare.

In 2015, there were nearly 170,000,000 records exposed, and that astronomical figure is just what we have been able to catalog. When cyber criminals run wild on your networks on average for 200 days before you know about it, that number most assuredly falls short of the actual impact. Cybersecurity breaches are increasing with a magnitude that is overwhelming.

Who is going to help turn the tide against these alarming trends? A recent report revealed that “More than 209,000 cybersecurity jobs in the U.S. are unfilled, and postings are up 74% over the past five years, according to a Peninsula Press (a project of the Stanford University Journalism Program) 2015 analysis of numbers from the Bureau of Labor Statistics.” It is pretty clear that while there currently is not enough talent to go around, this is only getting exponentially worse!

The upside for people who are currently in the cybersecurity profession or those who want to get into it means that:

1. You are going to make about 9% more than other IT workers do at current compensation rates.
2. There is a 36.5% growth rate in cybersecurity career fields, which is not sustainable for companies and puts existing employees in higher demand to the highest bidder.

Another report included “A report from Cisco puts the global figure at one million cybersecurity job openings. The demand for the (cybersecurity) workforce is expected to rise to 6 million (globally) by 2019, with a projected shortfall of 1.5 million,” stated Michael Brown, CEO at Symantec, the world’s largest security software vendor.” This only turns up the anxiety level in companies that are scrambling to avoid being the “breach du jour”.

Compounding matters is that there is a significant increase in regulatory and compliance requirements across all industries. Every compliance framework out there went through major overhauls in 2015. In some cases, as is the case for the SSAE 16, doubled in complexity. The situation just got more expensive and complex.

The only clear answers for businesses that want to remain viable in the global cyber threatscape come in the form of increased efficiencies and leveraged resources. Two of the best solutions that have emerged to address these challenges are:

Retain a Cybervisor®

Why should only big business be able to afford world-class technology security executive representation? You retain attorneys and accountants to perform complex tasks and represent you; retain technology security executive services and subject matter experts just the same! Even with 7% to 15% average annual increases by cybersecurity providers, it is still less than 50% of the cost increases associated with employees.

Retaining the help from dedicated and verifiable cybersecurity experts costs less than the expense of hiring just one (1) cybersecurity employee. And yes, that was a plural, not a singular expert. With professional Cybervisor services, companies get the expertise of many seasoned experts who collaborate and stand together to support their clients.

Automation is Your Friend

It’s time to work smarter and not harder! By utilizing automated cybersecurity and GRC tools, we have discovered that employees are so much more efficient and effective. In fact, utilizing a tool like ITAM consistently makes the cybersecurity, GRC assessments, and reporting processes a whopping 180% more efficient on average. When time is money, ITAM is like getting three (3) dedicated cybersecurity employees for less than the cost of one (1).

This concept of working smarter, not harder, applies to all cybersecurity and GRC service providers worldwide. Why pay for your current third-party provider’s overhead and antiquated assessment processes when you can significantly reduce your expenses and increase your profit margins simply by using a modern, intelligently designed, cutting-edge GRC tool like ITAM?

ITAM is an intelligently designed GRC tool that gets you from zero to compliance in record time by eliminating the audit anarchy you are accustomed to. There is a superior solution to this old-school problem, and ITAM is the keystone to that solution.

The Fallacy of Despair: Why your security breach is not inevitable!

There is a growing sentiment within the business community that a security breach affecting their company is inevitable. This is perpetuated by security professionals and providers or services and products who reinforce this mythos with statements resembling:

“It’s not if your company is going to be breached but when your company is going to be breached.”

We do not subscribe to this philosophy of fear; this fallacy of despair. We do not accept the inevitability of anything even death because we are convinced that science will fix that unfortunate end. All that being said, it should come as no surprise that of course we do not agree that your security breach needs to be inevitable.

Fear is the creeping, crawling, insidious splinter of doubt germinating in your mind that compels you to react at times irrationally. Fear is a management tool to control the many or the one. Fear requires two opposing forces to synchronize.

Codependency has been defined as the addiction to people, behaviors or things. Codependency is the fallacy of trying to control interior feelings by controlling people, things and events externally*. The fallacy of despair is that there is nothing we can do to stop a bad thing from occurring.

Keep in mind that reactive cybersecurity firms want you to fear the unknown, the possibility that your company will be inevitably breached. It is in their business model’s best interest to keep your corporation codependent. They would not be in business if breaches were prevented.

While we have a moment of clarity without fear, consider that a security breach is comprised of. On one side of the equation you have an entity who desires access to your organization for some malicious purpose. On your side of this equation you do not want to allow this to happen; so don’t allow this to happen!

Do not volunteer to be a victim.

If a technologist creates something and another technologist can break that something, don’t you think it is safe to say that another technologist could identify the problem first and prevent the intrusion? Do not submit to this fallacy of despair!

In the cybersecurity realm there are only two forms of security; Proactive Cybersecurity and Reactive Cybersecurity. Reactive cybersecurity is all about cleaning up the mess post-breach. Proactive cybersecurity is all about preventing the mess from ever occurring.

The best and only thing that a company can do to remain ahead of threats by being proactive in the appropriate implementation of Governance, Technology and Vigilance (AKA The Security Trifecta). When about 96% of all breaches are avoidable through the application of simple and intermediate level controls, it is absolutely within your power to protect your company. Let me show you the way; away from this fallacy of despair philosophy.

Lazarus Alliance is Proactive Cybersecurity.

*Wang, Charles R. Profound States of Despair: A Developmental and Systems Approach to Treating Emptiness. Boca Raton, FL: Universal, 2009. Print.

How do you quantify the true cost of a data breach? How do you measure the costs against the benefits of eliminating risks, mitigating risks or accepting risks to your business effectively?

The Lazarus Alliance executive leadership team has been the proverbial tip of the spear within the proactive cybersecurity realm well before there were actually corporate security departments and before the role of Chief Information Security Officer (CISO) entered our collective taxonomy.

It seemed only logical when you think like a futurist that our technological proliferation would only accelerate (it certainly has!) and that cybersecurity would predominantly factor into this equation (the understatement for the day!).

As with any analytical pursuit, the more data you have to analyze the better the outcome will be. Measuring the cost of a data breach is no exception to this rule. The cybersecurity industry and the practitioners within it now have ample data sets to draw from. The big task that remains is really a question (actually several but who is counting?) again and they are whether or not the security leadership within your organization has the:

1. The competency to do the job
2. The capability to do the job
3. The fortitude to do the job

Therein lies the wildcard. The human element once again is the weakest link in the chain between absolute cybersecurity and the lack thereof. It is important to point out that the first rule in the laws of security are that there is no such thing as absolute cybersecurity unless you cut the cord.

Now that we are at a place that resembles despair, let’s examine some facts that will help corporate leadership beginning with the Chief Executive Officer (CEO) down through the corporate ranks. It behooves us to distill the many facets of cybersecurity into the most obvious and most simplest of forms; proactive cybersecurity and reactive cybersecurity.

Reactive Cybersecurity

By definition, reactive cybersecurity is when it’s too late for preventive measures. You company is in the news and on the next industry breach report. The CEO, CIO and CISO are most likely going to be on the head chopping block. If your company survives, there will be huge litigation costs and long term reputation damage that is almost impossible to quantify.

Depending on what breach statistical report you choose, on average the cost of a singular human database record is $205 USD. Using some very complex mathematics (A*B=C) we can estimate the costs of a data breach which will help us make decisions on how to be proactive in the pursuit of risk elimination to our organizations.

For example, recently published on CNN was “Government investigators now believe that the data theft from the Office of Personnel Management computer systems compromised sensitive personal information, including Social Security numbers, of roughly 21.5 million people from both inside and outside the government, the government announced Thursday.”

Let’s do the math!

$205.00 multiplied by 21,500,000 records equals the estimated cost of the Office of Personnel Management data breach is going to be $4,407,500,000.00! (Expletives omitted at this point!)

What are some additional ancillary costs of this breach:

1. The Office of Personnel Management will never be trusted again
2. The CIO and CISO should lose their jobs in utter disgrace due to their egregious negligence
3. The US taxpayers will be strapped with the costs for decades

We have some eye popping and sleep losing facts to take away from this data that we can apply to the organizations we are responsible for. You should have a reasonable idea of how many records you are the custodian of so use this information to calculate another mathematical decision making tool; annualized loss expectancy (ALE).

ALE is an integral part of a proactive risk assessment so lets move on to proactive measures; more on ALE in a moment.

Proactive Cybersecurity

By definition, proactive cybersecurity is all about preventing a data breach through the effective and appropriate implementation of controls and countermeasures. It’s all about keeping your company out of the news and off those industry breach reports.

Think about what it costs to have a third part risk assessment or compliance audit. From a holistic perspective it is trivial when compared to the cost of a data breach. The numbers don’t lie. Taking a proactive approach to cybersecurity is far less expensive on order of magnitudes. What we are finding is that the cost on average to proactively address security, risk, audit and governance is less than the cost of a single CISO level employee!

To quote William Ochs, a partner in the Lazarus Alliance GRC practice, “With every successive breach we continue to see that organizations miss the adage that an ounce of prevention is worth a pound of cure. It seems that in the complexity of cybersecurity, the most common sense proactive steps are ignored and we keep paying by the pound.”

The best place to begin is with an IT Risk Assessment. Properly conducted, and surveys indicate that 59% of all organizations do not, would eliminate most threats to the business. Quite specifically when you analyze the big breaches over the past 12 months you will find that 100% are attributed to human hacking and 96% could have been prevented by implementing simple and medium grade controls. All of these are easily identified through a proper risk assessment.

Part of every risk assessment includes calculating costs and expenses to eliminate risks which is finally where ALE comes in. While ALE was originally meant for accountants only, the executive leadership of Lazarus Alliance discovered that it made perfect sense for cost center lines of business like cybersecurity.

To provide a brief explanation of how it is calculated, there are two factors that comprise the ALE. They are the Single Loss Expectancy (SLE), which is the percentage of the asset you are attempting to protect that would be lost in a single exposure, and the Annualized Rate of Occurrence (ARO), which is the frequency the loss event occurs in a year. Those two factors multiplied together give you’re the ALE (ALE = SLE * ARO).

For example, suppose than an asset is valued at $200,000 and the single cost of exposure is $50,000. Your SLE is now defined as $50,000 right? How many times in a year do we expect this exposure event to occur in a year? If we expect an exposure to occur once every year, then ARO is 100% whereas if we think there is a 50/50 shot, our ARO is now 50% right? For discussion purposes, let’s suggest we think there is a 50/50 chance an exposure might occur so our ARO is .5. With our SLE equaling $50,000, multiplied by our ARO of .5, the ALE is $25,000.

If you were to spend more than $25,000 for risk mitigation or avoidance by purchasing some security product, insurance or some legal service, you are spending too much. You are most certainly spending too much if the product or service you deploy does not eliminate the risk. If spending $25,000 does not set your ARO to zero, but say, cuts the risk down by 75% instead, you should reduce that $25,000 mitigation expense by 25% to bring everything back into a cost-effective risk avoidance measure.

We have explored the wildly different costs between proactive cybersecurity and reactive cybersecurity. Companies can no longer afford to go-it-alone when the stakes are so high. It’s not enough for the government or the private sector to enact rules and regulations; you need qualified assistance to make it happen.

Lazarus Alliance is Proactive Cybersecurity®