How do you quantify the true cost of a data breach? How do you measure the costs against the benefits of eliminating risks, mitigating risks or accepting risks to your business effectively?

The Lazarus Alliance executive leadership team has been the proverbial tip of the spear within the proactive cyber security realm well before there were actually corporate security departments and before the role of Chief Information Security Officer (CISO) entered our collective taxonomy.

It seemed only logical when you think like a futurist that our technological proliferation would only accelerate (it certainly has!) and that cyber security would predominantly factor into this equation (the understatement for the day!).

As with any analytical pursuit, the more data you have to analyze the better the outcome will be. Measuring the cost of a data breach is no exception to this rule. The cyber security industry and the practitioners within it now have ample data sets to draw from. The big task that remains is really a question (actually several but who is counting?) again and they are whether or not the security leadership within your organization has the:

1. The competency to do the job
2. The capability to do the job
3. The fortitude to do the job

Therein lies the wildcard. The human element once again is the weakest link in the chain between absolute cyber security and the lack thereof. It is important to point out that the first rule in the laws of security are that there is no such thing as absolute cyber security unless you cut the cord.

Now that we are at a place that resembles despair, let’s examine some facts that will help corporate leadership beginning with the Chief Executive Officer (CEO) down through the corporate ranks. It behooves us to distill the many facets of cyber security into the most obvious and most simplest of forms; proactive cyber security and reactive cyber security.

Reactive Cyber Security

By definition, reactive cyber security is when it’s too late for preventive measures. You company is in the news and on the next industry breach report. The CEO, CIO and CISO are most likely going to be on the head chopping block. If your company survives, there will be huge litigation costs and long term reputation damage that is almost impossible to quantify.

Depending on what breach statistical report you choose, on average the cost of a singular human database record is $205 USD. Using some very complex mathematics (A*B=C) we can estimate the costs of a data breach which will help us make decisions on how to be proactive in the pursuit of risk elimination to our organizations.

For example, recently published on CNN was “Government investigators now believe that the data theft from the Office of Personnel Management computer systems compromised sensitive personal information, including Social Security numbers, of roughly 21.5 million people from both inside and outside the government, the government announced Thursday.”

Let’s do the math!

$205.00 multiplied by 21,500,000 records equals the estimated cost of the Office of Personnel Management data breach is going to be $4,407,500,000.00! (Expletives omitted at this point!)

What are some additional ancillary costs of this breach:

1. The Office of Personnel Management will never be trusted again
2. The CIO and CISO should lose their jobs in utter disgrace due to their egregious negligence
3. The US taxpayers will be strapped with the costs for decades

We have some eye popping and sleep losing facts to take away from this data that we can apply to the organizations we are responsible for. You should have a reasonable idea of how many records you are the custodian of so use this information to calculate another mathematical decision making tool; annualized loss expectancy (ALE).

ALE is an integral part of a proactive risk assessment so lets move on to proactive measures; more on ALE in a moment.

Proactive Cyber Security

By definition, proactive cyber security is all about preventing a data breach through the effective and appropriate implementation of controls and countermeasures. It’s all about keeping your company out of the news and off those industry breach reports.

Think about what it costs to have a third part risk assessment or compliance audit. From a holistic perspective it is trivial when compared to the cost of a data breach. The numbers don’t lie. Taking a proactive approach to cyber security is far less expensive on order of magnitudes. What we are finding is that the cost on average to proactively address security, risk, audit and governance is less than the cost of a single CISO level employee!

To quote William Ochs, a partner in the Lazarus Alliance GRC practice, “With every successive breach we continue to see that organizations miss the adage that an ounce of prevention is worth a pound of cure. It seems that in the complexity of cyber security, the most common sense proactive steps are ignored and we keep paying by the pound.”

The best place to begin is with an IT Risk Assessment. Properly conducted, and surveys indicate that 59% of all organizations do not, would eliminate most threats to the business. Quite specifically when you analyze the big breaches over the past 12 months you will find that 100% are attributed to human hacking and 96% could have been prevented by implementing simple and medium grade controls. All of these are easily identified through a proper risk assessment.

Part of every risk assessment includes calculating costs and expenses to eliminate risks which is finally where ALE comes in. While ALE was originally meant for accountants only, the executive leadership of Lazarus Alliance discovered that it made perfect sense for cost center lines of business like cyber security.

To provide a brief explanation of how it is calculated, there are two factors that comprise the ALE. They are the Single Loss Expectancy (SLE), which is the percentage of the asset you are attempting to protect that would be lost in a single exposure, and the Annualized Rate of Occurrence (ARO), which is the frequency the loss event occurs in a year. Those two factors multiplied together give you’re the ALE (ALE = SLE * ARO).

For example, suppose than an asset is valued at $200,000 and the single cost of exposure is $50,000. Your SLE is now defined as $50,000 right? How many times in a year do we expect this exposure event to occur in a year? If we expect an exposure to occur once every year, then ARO is 100% whereas if we think there is a 50/50 shot, our ARO is now 50% right? For discussion purposes, let’s suggest we think there is a 50/50 chance an exposure might occur so our ARO is .5. With our SLE equaling $50,000, multiplied by our ARO of .5, the ALE is $25,000.

If you were to spend more than $25,000 for risk mitigation or avoidance by purchasing some security product, insurance or some legal service, you are spending too much. You are most certainly spending too much if the product or service you deploy does not eliminate the risk. If spending $25,000 does not set your ARO to zero, but say, cuts the risk down by 75% instead, you should reduce that $25,000 mitigation expense by 25% to bring everything back into a cost-effective risk avoidance measure.

We have explored the wildly different costs between proactive cyber security and reactive cyber security. Companies can no longer afford to go-it-alone when the stakes are so high. It’s not enough for the government or the private sector to enact rules and regulations; you need qualified assistance to make it happen.

Lazarus Alliance is Proactive Cyber Security®

Cyber Attack: United Airlines, WSJ, NYSE … Oh My!!

While United Airlines grounded their entire fleet and the Wall Street Journal was off-line and the New York Stock Exchange could not conduct trading yesterday for an extended period of time, they all have stated that they were not under a cyber attack.

We do not believe in coincidences!

Apparently we are not alone with this cyber attack sentiment. The Phoenix Business Journal conducted an engaging cyber attack conversation with us about it.

Computer network problems and outages brought the New York Stock Exchange to a halt, temporarily grounded United Airlines flights and took down The Wall Street Journal’s website Wednesday.

While none of the affected businesses blamed the problems on cyber attack by Russian, North Korean, Chinese or ISIS hackers, their troubles show the vulnerability and potential minefields for U.S. computer and communications networks.

Businesses, large and small, as well as consumers are dependent on communications systems and computer networks in their day-to-day lives.
If technical glitches can halt NYSE trading on Wall Street and force United to ground and delay flights, think of what they can do to Main Street businesses, startups and personal lives.

United Airlines’ troubles adversely impacted a couple dozen flights at Phoenix Sky Harbor International Airport today, according to FlightAware.com. Chicago, New York, Atlanta and Los Angeles had major delays.

A cyber security expert suspects today’s problems may stem from malware contracted from a third-party vendor rather than from nefarious hackers invading U.S. business systems from a dark room in Moscow, Pyongyang or Shanghai. “If you look at all the cyber attacks in the last 12 months, 100 percent of their breaches happened due to human interaction on third party networks,” said Michael Peters, CEO of Lazarus Alliance, a cyber security company:. “Employees of a third party company will download malware and forward it to a company, allowing cyber attacks.”

United officials blamed router problems on their network problems. “An attack can certainly happen through a router,” said Peters. “A router isn’t any different from network devices, they follow all the same rules. So a cyber attack can happen when a router is hacked and traffic is rerouted.”
Peters explained that routers are like highways, controlling network traffic. When cyber attacks happen, hackers can “reroute” traffic and effectively send data to other locations where it can be forwarded to another location.

Peters said most companies who are hacked, even large organizations, don’t have proactive measures in place, leaving them vulnerable.

The Proverbial Identity Theft Bus Will Run You Over!

Think about a time when you had a single credit card lost or stolen and how much of a pain that experience was. Now imagine if your entire wallet was lost or stolen and the exponential magnitude of pain in the patootie that would be for you.

If you are a subscriber to identity theft protection disservice providers, they are the custodians of a subscriber’s (this means you!) entire portfolio of financial account information, credit cards numbers, current and former address history, family names, social security number, power of attorney and everything else you care to chuck into their systems. To make matters worse, you can now add web site account user names and passwords.

What you now have is a cornucopia of identity theft and cyber criminal fun all in one place, neatly packaged up for hackers in one convenient location. Referring back to my wallet analogy, the database entrusted to these identity theft protection disservice providers is bigger than your wallet; it’s now your entire financial and personal history.

Not only are these providers reckless, they are incompetent from a cyber security and consumer protection perspective. Further proof that you are precariously about to be swinging in the wind is to only look as far as their advertisements and marketing campaigns. They seem to think that it makes great advertising to ridicule Russian hackers or other cyber criminals portrayed as troglodytes.

When you poke a stick into a hornets’ nest, eventually you are going to get stung. In doing so, these identity theft protection disservice providers risk the subscribers mother lode of personal identity data for the sake of theatrics. You may recall a rather stupid marketing stunt by a CEO with a bullhorn shouting his social security number out. He could not prevent his own identity from being stolen 12+ times and counting. How can they protect subscribers?

Now comes a bigger consumer problem that would add insult to injury. Have you ever looked at the policy acknowledgement for your financial institution? I’ll share some current language to Chase which states:

“We may at our option change the parameters for the password used to access the Online Service (“Password”) without prior notice to you, and if we do so, you will be required to change your password the next time you access the Online Service. To prevent unauthorized access to your accounts and to prevent unauthorized use of the Online Service, you agree to protect and keep confidential your Card number, account number, PIN, User ID, Password, or other means of accessing your accounts via the Online Service. The loss, theft, or unauthorized use of your Card numbers, account numbers, PINs, User IDs, and Passwords could cause you to lose some or all of the money in your accounts, plus any amount available under your overdraft protection credit line, or draws on your credit card account. It could also permit unauthorized persons to gain access to your sensitive personal and account information and to use that information for fraudulent purposes, including identity theft. If you disclose your Card numbers, account numbers, PINs, User IDs, and/or Passwords to any person(s) or entity, you assume all risks and losses associated with such disclosure. If you permit any other person(s) or entity, including any data aggregation service providers, to use the Online Service or to access or use your Card numbers, account numbers, PINs, User IDs, Passwords, or other means to access your accounts, you are responsible for any transactions and activities performed from your accounts and for any use of your personal and account information by such person(s) or entity. If you believe someone may attempt to use or has used the Online Service without your permission, or that any other unauthorized use or security breach has occurred, you agree to immediately notify us at 1-877-242-7372, (J.P. Morgan Online clients only, call 866-265-1727 or 302-634-5115 for international clients).”

Here is another from Wells Fargo which states the same:

“You are responsible for protecting your password and account information by not disclosing your personal account information to others (including your ATM PIN, online username, and password).”

I can’t help but see the proverbial bus that will run over consumers when an identity theft protection disservice provider is breached. Consumers will look to their banks for assistance and the banks will refuse to cover the damages. It’s not due to consumer negligence. It’s due to custodian negligence and deceptive business practices of these identity theft protection disservice providers.

Look before you leap!

Lazarus Alliance is Proactive Cyber Security®