The Fallacy of Despair: Why your security breach is not inevitable!

There is a growing sentiment within the business community that a security breach affecting their company is inevitable. This is perpetuated by security professionals and providers or services and products who reinforce this mythos with statements resembling:

“It’s not if your company is going to be breached but when your company is going to be breached.”

We do not subscribe to this philosophy of fear; this fallacy of despair. We do not accept the inevitability of anything even death because we are convinced that science will fix that unfortunate end. All that being said, it should come as no surprise that of course we do not agree that your security breach needs to be inevitable.

Fear is the creeping, crawling, insidious splinter of doubt germinating in your mind that compels you to react at times irrationally. Fear is a management tool to control the many or the one. Fear requires two opposing forces to synchronize.

Codependency has been defined as the addiction to people, behaviors or things. Codependency is the fallacy of trying to control interior feelings by controlling people, things and events externally*. The fallacy of despair is that there is nothing we can do to stop a bad thing from occurring.

Keep in mind that reactive cyber security firms want you to fear the unknown, the possibility that your company will be inevitably breached. It is in their business model’s best interest to keep your corporation codependent. They would not be in business if breaches were prevented.

While we have a moment of clarity without fear, consider that a security breach is comprised of. On one side of the equation you have an entity who desires access to your organization for some malicious purpose. On your side of this equation you do not want to allow this to happen; so don’t allow this to happen!

Do not volunteer to be a victim.

If a technologist creates something and another technologist can break that something, don’t you think it is safe to say that another technologist could identify the problem first and prevent the intrusion? Do not submit to this fallacy of despair!

In the cyber security realm there are only two forms of security; Proactive Cyber Security and Reactive Cyber Security. Reactive cyber security is all about cleaning up the mess post-breach. Proactive cyber security is all about preventing the mess from ever occurring.

The best and only thing that a company can do to remain ahead of threats by being proactive in the appropriate implementation of Governance, Technology and Vigilance (AKA The Security Trifecta). When about 96% of all breaches are avoidable through the application of simple and intermediate level controls, it is absolutely within your power to protect your company. Let me show you the way; away from this fallacy of despair philosophy.

Lazarus Alliance is Proactive Cyber Security.

*Wang, Charles R. Profound States of Despair: A Developmental and Systems Approach to Treating Emptiness. Boca Raton, FL: Universal, 2009. Print.

The Proverbial Identity Theft Bus Will Run You Over!

Think about a time when you had a single credit card lost or stolen and how much of a pain that experience was. Now imagine if your entire wallet was lost or stolen and the exponential magnitude of pain in the patootie that would be for you.

If you are a subscriber to identity theft protection disservice providers, they are the custodians of a subscriber’s (this means you!) entire portfolio of financial account information, credit cards numbers, current and former address history, family names, social security number, power of attorney and everything else you care to chuck into their systems. To make matters worse, you can now add web site account user names and passwords.

What you now have is a cornucopia of identity theft and cyber criminal fun all in one place, neatly packaged up for hackers in one convenient location. Referring back to my wallet analogy, the database entrusted to these identity theft protection disservice providers is bigger than your wallet; it’s now your entire financial and personal history.

Not only are these providers reckless, they are incompetent from a cyber security and consumer protection perspective. Further proof that you are precariously about to be swinging in the wind is to only look as far as their advertisements and marketing campaigns. They seem to think that it makes great advertising to ridicule Russian hackers or other cyber criminals portrayed as troglodytes.

When you poke a stick into a hornets’ nest, eventually you are going to get stung. In doing so, these identity theft protection disservice providers risk the subscribers mother lode of personal identity data for the sake of theatrics. You may recall a rather stupid marketing stunt by a CEO with a bullhorn shouting his social security number out. He could not prevent his own identity from being stolen 12+ times and counting. How can they protect subscribers?

Now comes a bigger consumer problem that would add insult to injury. Have you ever looked at the policy acknowledgement for your financial institution? I’ll share some current language to Chase which states:

“We may at our option change the parameters for the password used to access the Online Service (“Password”) without prior notice to you, and if we do so, you will be required to change your password the next time you access the Online Service. To prevent unauthorized access to your accounts and to prevent unauthorized use of the Online Service, you agree to protect and keep confidential your Card number, account number, PIN, User ID, Password, or other means of accessing your accounts via the Online Service. The loss, theft, or unauthorized use of your Card numbers, account numbers, PINs, User IDs, and Passwords could cause you to lose some or all of the money in your accounts, plus any amount available under your overdraft protection credit line, or draws on your credit card account. It could also permit unauthorized persons to gain access to your sensitive personal and account information and to use that information for fraudulent purposes, including identity theft. If you disclose your Card numbers, account numbers, PINs, User IDs, and/or Passwords to any person(s) or entity, you assume all risks and losses associated with such disclosure. If you permit any other person(s) or entity, including any data aggregation service providers, to use the Online Service or to access or use your Card numbers, account numbers, PINs, User IDs, Passwords, or other means to access your accounts, you are responsible for any transactions and activities performed from your accounts and for any use of your personal and account information by such person(s) or entity. If you believe someone may attempt to use or has used the Online Service without your permission, or that any other unauthorized use or security breach has occurred, you agree to immediately notify us at 1-877-242-7372, (J.P. Morgan Online clients only, call 866-265-1727 or 302-634-5115 for international clients).”

Here is another from Wells Fargo which states the same:

“You are responsible for protecting your password and account information by not disclosing your personal account information to others (including your ATM PIN, online username, and password).”

I can’t help but see the proverbial bus that will run over consumers when an identity theft protection disservice provider is breached. Consumers will look to their banks for assistance and the banks will refuse to cover the damages. It’s not due to consumer negligence. It’s due to custodian negligence and deceptive business practices of these identity theft protection disservice providers.

Look before you leap!

Lazarus Alliance is Proactive Cyber Security®

Federal cyber security breach has left millions of American citizens as casualties. Lazarus Alliance responds with proactive cyber-crime prevention.

Lazarus Alliance ups the ante with proactive cyber security weapons in the corporate arsenal to fight cybercrime, corporate fraud, espionage and criminal cyber-misconduct.

The egregious revelations following this security breach is that the Office of Personnel Management did not have even entry-level cyber security controls in place as reported on June 4, 2015 by NBC affiliate KPNX 12 News and many other outlets is proof that it’s time for the U.S. to take strong action to harden its technological infrastructure with proactive measures instead of the reactive posture demonstrated today.

KPNX went on to report that “Fundamental controls missing that facilitated this massive security breach affecting millions across the federal space were identified as a lack of data encryption, multifactor authentication and modern endpoint computing platforms all of which are critical in preventing cyber breaches and criminal misconduct.”

Michael Peters, CEO of Lazarus Alliance said “Proactive cyber security measures taken through competent IT risk, audit & compliance and governance assessments coupled with proven assessment tools like the IT Audit Machine are all known to prevent about 96% of all breach potential.”

“As long as public and private organizations remain reactive instead of proactive in their approach to cyber security, they will continue to fail the constituents they work to protect. This federal cyber data breach is a painful reminder that not enough is being done even at minimal levels.” said Peters.

Cyber-crime prevention is of paramount concern to the federal government and organizations of all sizes, all industries and in all parts of the world. Lazarus Alliance put its extensive experience in cybercrime and fraud prevention in the governance, risk and compliance (GRC) spaces to work for the federal and global business community.

“Survey after survey shows that simple and intermediate controls prevent espionage and cyber-crime and yet breach reports are escalating. These criminal acts could have been prevented through a proactive cyber security plan. Lazarus Alliance is proactive cyber security.” continued Peters.

Lazarus Alliance’s primary purpose is to help organizations attain, maintain, and demonstrate compliance and information security excellence, in any jurisdiction. Lazarus Alliance specializes in IT security, risk, privacy, governance, cyberspace law and compliance leadership solutions and is fully dedicated to global success in these disciplines.

Learn more about Lazarus Alliance and why Lazarus Alliance is Proactive Cyber Security™

Video: https://youtu.be/8eRv4zc9l4M