The proliferation of cyber attacks and the persistent threat of data breaches makes having a strong cybersecurity program paramount. This guide will educate you on the origin of these attacks, who the actors are, and provide actionable steps for building a strong cyber security program or strengthening the one you have.
What is cyber risk?
The Institute of Risk Management defines cyber risk as “any risk of financial loss, disruption or damage to the reputation of an organization from some sort of failure of its information technology systems.” As your digital footprint expands, the increased attack surface for cyber breaches makes organizations more vulnerable. Disruptive business models, and accelerated adoption of new technologies like mobility and cloud, unveil new threats daily. Today’s organizations cannot afford to make security an afterthought.
History of cyber security risk management
Since the late 80s, digital systems have been vulnerable to attacks from internet pirates trying to steal information and gain unauthorized access. The Morris Worm was the first widespread denial-of-service (DoS) attack in 1989, affecting 6,000 computers and costing anywhere from $100,000 to $10,000,000 worth of damage. That attack set the stage for much larger attacks that today threaten millions of systems with a heftier price tag (consider the 2013 cyberattack on Target retail stores that impacted 40 million credit cards).
Early on, Computer Emergency Response Teams (CERTs) would be deployed to respond to any cyberattacks. These tactical teams would repair damage when an incident occurred but didn’t have the tools for preventing future attacks. Enter antivirus software. This became the gold-standard for cybersecurity and was often used as the primary means of warding off a future attack. Antivirus software served organizations well until the second part of the 21st century. That's when the world began to see an uptick in the scale and severity of cyber attacks. Two of the most recent and notorious security breaches, WannaCry and Eternal Blue, left stalwarts like the National Security Agency reeling. But now rather than looking for the next silver bullet, organizations realize they need an arsenal of cybersecurity tactics and a security team that works to stay one step ahead of the bad guys.
Where do cyber attacks come from?
We use the term “threat actor” to define the person or group who are behind cyber crime – either orchestrating it or causing it. Based on our latest Data Breach Investigations Report, these are the threat actors causing a majority of the breaches:
Organized Crime: Cybercriminals are largely driven by financial gain. They might seek personally identifiable information (PII) of your customers or employees, such as social security numbers, health records, credit cards, and banking information. Or, they look to hijack and ransom critical resources.
State-affiliated actors: These groups are typically motivated by political, economic, technical, or military agendas. They seek information to exploit it for espionage purposes. State-affiliated actors account for 79 percent of all breaches involving external actors.
Activists: These attackers have a political agenda and seek to spread propaganda or generate awareness for a cause. This type of actor has been on the decline over the past few years.
Insiders: These types of attackers are those with insider access to organizational data. Misuse by current employees is often the cause. But these can also include former employees and partners looking for revenge or financial gain.
Internal Users: Breaches can be caused by errors or mismanagement of data by well-intentioned employees. This may be due to network issues, poor data management protocols, or by providing privileges to those who should not have them.
Standardizing Cyber Risk Management
As cybersecurity has become a top priority for organizations, standardized risk management processes and protocols have emerged. These include information security and operational risk models, such as FAIR, ISO, COSO and NIST.
COSO defines enterprise risk management as “a process, effected by an entity’s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.”
Out of these models three key pillars have emerged, serving as starting points for achieving operational resilience and mitigating cyber risk:
1. Governance Structure –Risk management should have a top-down approach. Consider establishing a risk committee that stays in regular contact with C-Suite leaders. This committee can establish a sound cyber risk management protocol and ensure the entire organization adheres to it.
2. Risk Appetite – An organization must decide how much risk it can tolerate. After all, some level of risk is unavoidable as a part of doing business in the modern age. By defining your risk appetite, you empower employees at all levels of the organization to raise the alarm whenever they perceive potential vulnerabilities.
3. Policy and Procedure – Your risk management plan should integrate naturally into your work culture. Incorporate risk management policies at every level of the organization. Employees should have a baseline understanding of risk concepts and know how to put them into action from day one. Conduct an inventory of every data-driven asset you have and develop policies around each one that address vulnerabilities and mitigate risk.
Failure to maintain a sound cyber risk management practice has significant consequences. Organizations face the risk of a breach of assets, as well as incidents that threaten the integrity of the business. But beyond that, you may also experience a loss of customers and incur administrative fines or even civil litigation. Companies doing business within the EU must also abide by the Global Data Protection Regulation (GDPR) data management and privacy standards. The penalty for noncompliance with GDPR (and so many other ever-emerging regulations) is significant.
Cyber Risk Checklist
If you are realizing your need for a more robust cybersecurity strategy, now’s the time to act! Start by asking yourself the following questions:
- What is the current level and business impact of cyber risks to our company? What is our plan to address identified risks?
- How is our executive leadership informed about cyber risks to our company?
- How does our cybersecurity program apply industry standards and best practices?
- How many and what types of cyber incidents do we detect in a normal week? What is the threshold for notifying our executive leadership?
- How comprehensive is our cyber incident response plan? How often is the plan tested?
- Do we have a strong password policy? Do we enforce this policy across the organization?
- Where does our data live? This includes servers and workstations, mobile devices, thumb drives, backup systems and cloud locations.
- What do we do with physical files and draft documents that contain personally identifiable information?
- Do we encrypt any backup media that leaves the office and also validate that the backup is complete and usable?
- Have we educated employees about good security practices? This includes cybersecurity attack methods such as phishing and pharming, and ransomware and social media threats. Has our staff received email security threat training?
- If there is a breach, do we have a response plan in place? Do we have cybersecurity insurance in the case of a breach incident?
How Verizon can help
Answering these questions is just the first step toward developing the robust cybersecurity protocol your organization needs. Our Cyber Risk Monitoring conducts a personalized analysis of your organization’s risk posture and provides steps for remediation. We combine the world-class capabilities of leading security organizations with Verizon’s own unique intelligence, giving you an in-depth view of your security landscape.
Verizon has helped some of the largest and most complex organizations in the United States keep a lockdown on their security. Learn how Verizon helped the U.S. military strengthen their cyber risk defense.
Kuongezeka kwa mashambulizi ya mtandao na tishio la kudumu la uvunjaji wa data hufanya kuwa na programu thabiti ya usalama wa mtandao kuwa muhimu zaidi. Mwongozo huu utakufundisha juu ya asili ya mashambulizi haya, ni nani watendaji, na kutoa hatua za vitendo za kujenga programu thabiti ya usalama wa mtandao au kuimarisha ile uliyo nayo. Hatari ya Mtandao ni nini? "Kama Taasisi ya Usimamizi wa Hatari inafafanua ""hatari ya hatari ya uharibifu wa kifedha, usumbufu au uharibifu wa sifa ya shirika kutokana na aina fulani ya kushindwa kwa mifumo yake ya teknolojia ya habari,"" ""Uwezo wa mtandao wa uharibifu wa mtandao unaongezeka, na kupanua mwelekeo wa uharibifu wa mtandao." Mifano ya biashara ya kuvuruga, na kupitishwa kwa kasi kwa teknolojia mpya kama usafiri na wingu, hufunua vitisho vipya kila siku. Mashirika ya leo hayawezi kumudu kufanya usalama kuwa wazo la baadaye. Tangu mwishoni mwa miaka ya 1980, mifumo ya dijiti imekuwa dhaifu kwa mashambulizi kutoka kwa maharamia wa mtandao kujaribu kuiba habari na kupata upatikanaji usioidhinishwa. "Kama ""Worm Morris"" - mashambulizi ya kwanza ya kukataa huduma (DoS) - ilisababisha uharibifu wa kompyuta 6,000 na gharama ya $ 100,000 hadi $ 10,000,000." Shambulio hilo lilianzisha hatua kwa mashambulizi makubwa zaidi ambayo leo yanatishia mamilioni ya mifumo na tag ya bei kubwa (fikiria shambulio la mtandao la 2013 kwenye maduka ya rejareja ya Lengo ambalo liliathiri kadi za mkopo milioni 40). Katika hatua za kwanza, timu za kukabiliana na dharura za kompyuta (CERTs) zitatumika kujibu mashambulizi yoyote ya mtandao. Timu hizi za kimkakati zingeweza kurekebisha uharibifu wakati tukio lilipotokea lakini hazikuwa na zana za kuzuia mashambulizi ya baadaye. Kuingiza programu ya antivirus. Hii ikawa kiwango cha dhahabu kwa usalama wa mtandao na mara nyingi ilitumiwa kama njia ya msingi ya kuzuia shambulio la baadaye. Programu ya antivirus ilitumika vizuri kwa mashirika hadi sehemu ya pili ya karne ya 21. Wakati huo ndipo ulimwengu ulipoanza kuona ongezeko la kiwango na ukali wa mashambulizi ya mtandao. Uharibifu wa WannaCry na EternalBlue ulisababisha uharibifu mkubwa wa usalama wa Marekani. Lakini sasa, badala ya kutafuta risasi ya fedha inayofuata, mashirika yanatambua wanahitaji silaha ya mbinu za usalama wa mtandao na timu ya usalama inayofanya kazi ili kubaki hatua moja mbele ya watu wabaya. Mashambulizi ya kompyuta hutoka wapi? Tunatumia neno "mtendaji wa tishio" kufafanua mtu au kikundi ambao wako nyuma ya uhalifu wa mtandao - ama kuupanga au kuusababisha. Kulingana na ripoti yetu ya hivi karibuni ya Uchunguzi wa Uvunjaji wa Takwimu, hawa ndio watendaji wa tishio wanaosababisha uvunjaji mwingi: Uhalifu uliopangwa: Wahalifu wa mtandao wanaongozwa kwa kiasi kikubwa na faida ya kifedha. Wanaweza kutafuta habari za kibinafsi za wateja wako au wafanyikazi wako, kama vile nambari za usalama wa kijamii, rekodi za afya, kadi za mkopo, na habari za benki. Au, wao hutafuta kuiba na kukomboa rasilimali muhimu. Watendaji wanaohusishwa na serikali: Vikundi hivi kwa kawaida huchochewa na ajenda za kisiasa, kiuchumi, kiufundi, au kijeshi. Wao hutafuta habari ili kuzitumia kwa makusudi ya ujasusi. "Watu wanaohusika na serikali wanawakilisha asilimia 79 ya makosa yote yanayohusisha watu wa nje.""" Wanaharakati: Washambuliaji hawa wana ajenda ya kisiasa na wanatafuta kueneza propaganda au kuzalisha ufahamu kwa sababu. Aina hii ya mwigizaji imekuwa ikipungua katika miaka michache iliyopita. Insiders: Aina hizi za washambuliaji ni wale walio na upatikanaji wa ndani kwa data ya shirika. Mara nyingi sababu ni matumizi mabaya ya wafanyakazi wa sasa. Lakini hizi pia zinaweza kujumuisha wafanyakazi wa zamani na washirika wakitafuta kulipiza kisasi au faida ya kifedha. Watumiaji wa ndani: Uvunjaji wa data unaweza kusababishwa na makosa au usimamizi mbaya wa data na wafanyikazi wenye nia nzuri. Hii inaweza kuwa kutokana na masuala ya mtandao, mifumo duni ya usimamizi wa data, au kwa kutoa upendeleo kwa wale ambao hawapaswi kuwa nao. Usimamizi wa Hatari za Cyber: Usalama wa mtandao umekuwa kipaumbele cha juu kwa mashirika, na taratibu za usimamizi wa hatari za kawaida zimeibuka. Mifano ya usalama wa habari na hatari ya uendeshaji (FAIR, ISO, COSO, NIST) CISO hufafanua usimamizi wa hatari ya biashara kama mchakato unaofanywa na bodi ya wakurugenzi, usimamizi na wafanyikazi wengine wa kampuni, kutumika katika kuweka mkakati na katika biashara nzima, iliyoundwa kutambua matukio ya uwezekano ambayo yanaweza kuathiri kampuni, na kusimamia hatari ili iwe ndani ya hamu yake ya hatari, kutoa uhakika wa busara kuhusu kufikia malengo ya kampuni. Utaratibu wa Utawala <unk>Usimamizi wa hatari unapaswa kuwa na mbinu ya juu-chini. Fikiria kuanzisha kamati ya hatari ambayo inabaki katika mawasiliano ya kawaida na viongozi wa C-Suite. Kamati hii inaweza kuanzisha itifaki nzuri ya usimamizi wa hatari ya mtandao na kuhakikisha shirika lote linafuata. 2. Uwezekano wa kupata Hatari hamu <unk> Shirika lazima kuamua kiasi gani cha hatari inaweza kuvumilia. Baada ya yote, kiwango fulani cha hatari ni lazima kama sehemu ya kufanya biashara katika enzi ya kisasa. Kwa kufafanua hamu yako ya hatari, unawapa wafanyikazi katika ngazi zote za shirika nguvu ya kutoa kengele wakati wowote wanapoona udhaifu wa uwezekano. 3. Uwe na mtazamo wa kweli Sera na Utaratibu <unk> Mpango wako wa usimamizi wa hatari unapaswa kuunganishwa kwa kawaida katika utamaduni wako wa kazi. Kuingiza sera za usimamizi wa hatari katika kila ngazi ya shirika. Wafanyakazi wanapaswa kuwa na uelewa wa msingi wa dhana za hatari na kujua jinsi ya kuziweka katika vitendo kutoka siku ya kwanza. Fanya orodha ya kila mali ya data unayo na kuendeleza sera zinazozunguka kila moja ambayo inashughulikia udhaifu na kupunguza hatari. Kushindwa kudumisha mazoezi mazuri ya usimamizi wa hatari ya mtandao kuna matokeo makubwa. Mashirika yanakabiliwa na hatari ya uvunjaji wa mali, pamoja na matukio ambayo yanatishia uadilifu wa biashara. Lakini zaidi ya hayo, unaweza pia kupata hasara ya wateja na kupata faini za kiutawala au hata kesi za kiraia. Kampuni zinazofanya biashara ndani ya EU lazima pia zifuate kanuni za usimamizi wa data na faragha za Kanuni ya Ulinzi wa Takwimu ya Ulimwenguni (GDPR). Adhabu kwa kutofuata GDPR (na kanuni nyingine nyingi zinazoibuka) ni kubwa. Orodha ya Uhatara wa Cyber Ikiwa unatambua hitaji lako la mkakati thabiti zaidi wa usalama wa cyber, sasa ni wakati wa kutenda! Anza kwa kujiuliza maswali yafuatayo: - Ni kiwango cha sasa na athari za biashara za hatari za mtandao kwa kampuni yetu? Ni nini mpango wetu wa kushughulikia hatari zilizotambuliwa? - Jinsi gani uongozi wetu mtendaji ni aliiambia kuhusu hatari za mtandao kwa kampuni yetu? - Jinsi gani programu yetu ya usalama wa mtandao inatumia viwango vya sekta na mazoea bora? - Ni matukio mangapi na ya aina gani ya mtandao tunagundua katika wiki ya kawaida? Kiwango cha kuarifu uongozi wetu wa mtendaji ni nini? - Mpango wetu wa kukabiliana na matukio ya kibiashara ni kamili kadiri gani? Mpango huo hujaribiwa mara nyingi kadiri gani? - Je, tuna sera kali ya nenosiri? Je, sisi kutekeleza sera hii katika shirika lote? - Takwimu zetu ziko wapi? Hii ni pamoja na seva na vituo vya kazi, vifaa vya rununu, thumb drives, mifumo ya kuhifadhi na maeneo ya wingu. - Tunafanya nini na faili za kimwili na rasimu za hati ambazo zina habari za kitambulisho cha kibinafsi? - Je, sisi encrypt yoyote ya kuhifadhi vyombo vya habari kwamba inaacha ofisi na pia kuthibitisha kwamba kuhifadhi ni kamili na usable? - Je, tumewaelimisha wafanyakazi kuhusu mazoea mazuri ya usalama? Hii inajumuisha mbinu za mashambulizi ya usalama wa mtandao kama vile phishing na pharming, na ransomware na vitisho vya media ya kijamii. Je, wafanyakazi wetu wamepokea mafunzo ya usalama wa barua pepe? - Ikiwa kuna uvunjaji, je, tuna mpango wa kukabiliana nao? Je, una bima ya usalama wa mtandao katika kesi ya tukio la uvunjaji? Jinsi Verizon inaweza kusaidia: Kujibu maswali haya ni hatua ya kwanza tu kuelekea kuendeleza itifaki ya usalama wa mtandao inayofaa ambayo shirika lako linahitaji. Ufuatiliaji wa Hatari ya Cyber hufanya uchambuzi wa kibinafsi wa msimamo wa hatari ya shirika lako na hutoa hatua za kurekebisha. Tunachanganya uwezo wa kiwango cha ulimwengu wa mashirika ya usalama wa kuongoza na akili ya kipekee ya Verizon, kukupa mtazamo wa kina wa mazingira yako ya usalama. Verizon imesaidia baadhi ya mashirika makubwa na tata zaidi nchini Marekani kuweka lockdown juu ya usalama wao. Verizon imesaidia jeshi la Marekani kuimarisha ulinzi wao dhidi ya hatari za mtandao