The Fallacy of Despair: Why your security breach is not inevitable!

The Fallacy of Despair: Why your security breach is not inevitable!

There is a growing sentiment within the business community that a security breach affecting their company is inevitable. This is perpetuated by security professionals and providers or services and products who reinforce this mythos with statements resembling:

“It’s not if your company is going to be breached but when your company is going to be breached.”

We do not subscribe to this philosophy of fear; this fallacy of despair. We do not accept the inevitability of anything even death because we are convinced that science will fix that unfortunate end. All that being said, it should come as no surprise that of course we do not agree that your security breach needs to be inevitable.

The Fallacy of Fear

Fear is the creeping, crawling, insidious splinter of doubt germinating in your mind that compels you to react at times irrationally. Fear is a management tool to control the many or the one. Fear requires two opposing forces to synchronize.

Codependency has been defined as the addiction to people, behaviors or things. Codependency is the fallacy of trying to control interior feelings by controlling people, things and events externally*. The fallacy of despair is that there is nothing we can do to stop a bad thing from occurring.

Keep in mind that reactive cyber security firms want you to fear the unknown, the possibility that your company will be inevitably breached. It is in their business model’s best interest to keep your corporation codependent. They would not be in business if breaches were prevented.

While we have a moment of clarity without fear, consider that a security breach is comprised of. On one side of the equation you have an entity who desires access to your organization for some malicious purpose. On your side of this equation you do not want to allow this to happen; so don’t allow this to happen!

Do not volunteer to be a victim.

If a technologist creates something and another technologist can break that something, don’t you think it is safe to say that another technologist could identify the problem first and prevent the intrusion? Do not submit to this fallacy of despair!

In the cyber security realm there are only two forms of security; Proactive Cyber Security and Reactive Cyber Security. Reactive cyber security is all about cleaning up the mess post-breach. Proactive cyber security is all about preventing the mess from ever occurring.

The best and only thing that a company can do to remain ahead of threats by being proactive in the appropriate implementation of Governance, Technology and Vigilance (AKA The Security Trifecta). When about 96% of all breaches are avoidable through the application of simple and intermediate level controls, it is absolutely within your power to protect your company. Let me show you the way; away from this fallacy of despair philosophy.

Lazarus Alliance is Proactive Cyber Security.

*Wang, Charles R. Profound States of Despair: A Developmental and Systems Approach to Treating Emptiness. Boca Raton, FL: Universal, 2009. Print.

CIO, CISO, Eee Eye, Eee Eye Oh Crap a Data Breach!

How do you quantify the true cost of a data breach? How do you measure the costs against the benefits of eliminating risks, mitigating risks or accepting risks to your business effectively?

Cost Benefit ROI
The Lazarus Alliance executive leadership team has been the proverbial tip of the spear within the proactive cyber security realm well before there were actually corporate security departments and before the role of Chief Information Security Officer (CISO) entered our collective taxonomy.

It seemed only logical when you think like a futurist that our technological proliferation would only accelerate (it certainly has!) and that cyber security would predominantly factor into this equation (the understatement for the day!).

As with any analytical pursuit, the more data you have to analyze the better the outcome will be. Measuring the cost of a data breach is no exception to this rule. The cyber security industry and the practitioners within it now have ample data sets to draw from. The big task that remains is really a question (actually several but who is counting?) again and they are whether or not the security leadership within your organization has the:

  1. The competency to do the job
  2. The capability to do the job
  3. The fortitude to do the job

Therein lies the wildcard. The human element once again is the weakest link in the chain between absolute cyber security and the lack thereof. It is important to point out that the first rule in the laws of security are that there is no such thing as absolute cyber security unless you cut the cord.

Now that we are at a place that resembles despair, let’s examine some facts that will help corporate leadership beginning with the Chief Executive Officer (CEO) down through the corporate ranks. It behooves us to distill the many facets of cyber security into the most obvious and most simplest of forms; proactive cyber security and reactive cyber security.

Reactive Cyber Security

By definition, reactive cyber security is when it’s too late for preventive measures. You company is in the news and on the next industry breach report. The CEO, CIO and CISO are most likely going to be on the head chopping block. If your company survives, there will be huge litigation costs and long term reputation damage that is almost impossible to quantify.

Depending on what breach statistical report you choose, on average the cost of a singular human database record is $205 USD. Using some very complex mathematics (A*B=C) we can estimate the costs of a data breach which will help us make decisions on how to be proactive in the pursuit of risk elimination to our organizations.

For example, recently published on CNN was “Government investigators now believe that the data theft from the Office of Personnel Management computer systems compromised sensitive personal information, including Social Security numbers, of roughly 21.5 million people from both inside and outside the government, the government announced Thursday.”

Let’s do the math!

$205.00 multiplied by 21,500,000 records equals the estimated cost of the Office of Personnel Management data breach is going to be $4,407,500,000.00! (Expletives omitted at this point!)

What are some additional ancillary costs of this breach:

  1. The Office of Personnel Management will never be trusted again
  2. The CIO and CISO should lose their jobs in utter disgrace due to their egregious negligence
  3. The US taxpayers will be strapped with the costs for decades

We have some eye popping and sleep losing facts to take away from this data that we can apply to the organizations we are responsible for. You should have a reasonable idea of how many records you are the custodian of so use this information to calculate another mathematical decision making tool; annualized loss expectancy (ALE).

ALE is an integral part of a proactive risk assessment so lets move on to proactive measures; more on ALE in a moment.

Proactive Cyber Security

By definition, proactive cyber security is all about preventing a data breach through the effective and appropriate implementation of controls and countermeasures. It’s all about keeping your company out of the news and off those industry breach reports.

Think about what it costs to have a third part risk assessment or compliance audit. From a holistic perspective it is trivial when compared to the cost of a data breach. The numbers don’t lie. Taking a proactive approach to cyber security is far less expensive on order of magnitudes. What we are finding is that the cost on average to proactively address security, risk, audit and governance is less than the cost of a single CISO level employee!

To quote William Ochs, a partner in the Lazarus Alliance GRC practice, “With every successive breach we continue to see that organizations miss the adage that an ounce of prevention is worth a pound of cure. It seems that in the complexity of cyber security, the most common sense proactive steps are ignored and we keep paying by the pound.”

The best place to begin is with an IT Risk Assessment. Properly conducted, and surveys indicate that 59% of all organizations do not, would eliminate most threats to the business. Quite specifically when you analyze the big breaches over the past 12 months you will find that 100% are attributed to human hacking and 96% could have been prevented by implementing simple and medium grade controls. All of these are easily identified through a proper risk assessment.

Part of every risk assessment includes calculating costs and expenses to eliminate risks which is finally where ALE comes in. While ALE was originally meant for accountants only, the executive leadership of Lazarus Alliance discovered that it made perfect sense for cost center lines of business like cyber security.

To provide a brief explanation of how it is calculated, there are two factors that comprise the ALE. They are the Single Loss Expectancy (SLE), which is the percentage of the asset you are attempting to protect that would be lost in a single exposure, and the Annualized Rate of Occurrence (ARO), which is the frequency the loss event occurs in a year. Those two factors multiplied together give you’re the ALE (ALE = SLE * ARO).

For example, suppose than an asset is valued at $200,000 and the single cost of exposure is $50,000. Your SLE is now defined as $50,000 right? How many times in a year do we expect this exposure event to occur in a year? If we expect an exposure to occur once every year, then ARO is 100% whereas if we think there is a 50/50 shot, our ARO is now 50% right? For discussion purposes, let’s suggest we think there is a 50/50 chance an exposure might occur so our ARO is .5. With our SLE equaling $50,000, multiplied by our ARO of .5, the ALE is $25,000.

If you were to spend more than $25,000 for risk mitigation or avoidance by purchasing some security product, insurance or some legal service, you are spending too much. You are most certainly spending too much if the product or service you deploy does not eliminate the risk. If spending $25,000 does not set your ARO to zero, but say, cuts the risk down by 75% instead, you should reduce that $25,000 mitigation expense by 25% to bring everything back into a cost-effective risk avoidance measure.

We have explored the wildly different costs between proactive cyber security and reactive cyber security. Companies can no longer afford to go-it-alone when the stakes are so high. It’s not enough for the government or the private sector to enact rules and regulations; you need qualified assistance to make it happen.

Lazarus Alliance is Proactive Cyber Security®

Proactive vs Reactive Cyber Security on Money Radio

Recently Michael Peters, CEO of Lazarus Alliance, spent time with David Cogan of Money Radio and eLiances discussing the differences between proactive cyber security and reactive cyber security. You can replay the broadcast as heard on money radio.

Michael Peters and David Cogan as heard on Money Radio

An overview of the discussion was when you think cyber security, what comes to your mind first?

I’ve posed that question to many an audience over the years and most frequently the response is what folks see on the nightly news or through some new source. Recently people will respond with examples such as Home Depot, Target, Sony, JP Morgan and the European Central Bank which of course are just a few of the most notable instances of breaches we seen in the news over the last twelve months.

I point out to these same groups that in reality, there are only two forms of cyber security and its Proactive Cyber Security and Reactive Cyber Security. I’ll explain what that means and let’s see if you agree.

Reactive Cyber Security situations are going to be in the news because something bad has happened. Reactive security companies help you clean up the mess. When you become aware of a cyber security breach at some company, it’s probably because you are watching the business catastrophe unfolding through some syndication source. You eventually get a notification by the company, your bank or credit card provider informing you that your private and personal information has been stolen which leaves you to worry and watch hoping that nothing bad happens to you.

From a business standpoint, it has become painfully obvious at all levels including shareholders that cyber breaches have a really negative impact on business value not to mention careers of everyone involved especially at the highest levels of the company. We have all seen for the first time in 2014 CEOs, CIOs and CISOs losing their jobs as a direct result of culpability or negligence on their part.

No doubt about it, cyber security breaches have a hugely negative impact on the financial health and reputation of the victim company.

So this brings me to the second form of cyber security which is proactive cyber security. Proactive Cyber Security is all about keeping you out of the news by implementing the right controls and countermeasures. We know it’s not enough for the government or the private sector to have rules and regulations. PCI DSS certification did not save Target, Home Depot or other retailers. The FFIEC or the NIST Framework for Improving Critical Infrastructure Cybersecurity did not save JP Morgan or other financial institutions from their breaches.

You need qualified assistance to make it effective. It’s tough when there are not enough talented cyber security professionals to go around. Businesses are short-staffed. Academia is not training and educating enough to keep up with the demand.

The best possible course of action to avoid being the latest corporate cyber security breach is to take a proactive approach. I’m the CEO and Lazarus Alliance is Proactive Cyber Security™.

Be sure to check out the dynamic group of hybrid entrepreneurs who spend time together at eLiances where entrepreneurs align hosted by David Cogan.

Michael Peters and David Cogan of eLiances

Thank you to Money Radio for inviting me to discuss the differences between Proactive and Reactive Cyber Security.

Michael Peters and David Cogan as heard on Money Radio