Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/24/2019
02:30 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

NormShield Enables Organizations to Calculate Potential Financial Impact of Cyberattacks on Suppliers, Partners

VIENNA, VA, September 24, 2019 – No matter how hardened a company’s cyber defenses are, significant risk remains when suppliers and third-party trading partners are attacked and compromised. Today, NormShield, the only provider of a standards-based external cyber risk assessment platform, unveiled the first-ever automated tool to combine and assess both cyber and financial risk.

Calculating the dollar value of the probable loss caused by an attack on a supplier or partner enables Chief Information Security Officers (CISOs), Chief Risk Officers (CROs) and Chief Financial Officers (CFO) to measure and mitigate cyber risk to business performance.

To measure the potential financial impact (risk) to an organization, NormShield uses the Factor Analysis of Information Risk (FAIR) Model, the only international standard Value at Risk (VaR) model for cybersecurity and operational risk.

“Incorporating the FAIR Model into cyber risk assessments enables organizations to effectively quantify the true financial cyber risk to their bottom lines,” said Mohamoud Jibrell, CEO of NormShield. “Companies now can have a three-dimensional view of the technical, compliance and financial impact of a cyberattack to better understand the full risk relationship with a partner or supplier. For some, the business benefits will outweigh the cyber risks but for others it may not.”

In financial services, for example, CISOs and CROs will be able to show the business that the threat of an attack on a vendor is real and gauge whether the odds are rising or falling. Further, CISOs and CROs can now show the business the financial impact of sharing fewer records with a vendor. The business can then determine which is greater, the reduction in probable costs from an attack on that vendor or the increase in revenue from sharing more records with that vendor.

A company’s vendors have different levels of importance. A vendor that does not have access to any systems or confidential data will have lower risk than that of a vendor that has access to PII data of company employees. The FAIR model allows NormShield to give a vendor business impact (Loss Magnitude) in risk calculation – from both the technical and financial perspectives.

“Every dollar spent on cyber risk management is a dollar that can’t be spent growing the business or addressing other organization imperatives,” said Jack Jones, chief risk scientist for RiskLens. “Consequently, cost-effective cyber risk management — knowing what matters most, and getting the best bang for your risk management buck — is a necessary cornerstone of organization success.”

The FAIR methodology was conceived as a way to provide meaningful measurements to satisfy management's desire to make effective comparisons and well-informed decisions. FAIR has become the only international standard Value at Risk (VaR) model for cybersecurity and operational risk.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-0488
PUBLISHED: 2021-04-15
In pb_write of pb_encode.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-178754781
CVE-2021-27129
PUBLISHED: 2021-04-15
CASAP Automated Enrollment System version 1.0 contains a cross-site scripting (XSS) vulnerability through the Students > Edit > ROUTE parameter.
CVE-2021-27544
PUBLISHED: 2021-04-15
Cross Site Scripting (XSS) in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "sername" parameter.
CVE-2021-27545
PUBLISHED: 2021-04-15
SQL Injection in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allows remote attackers to obtain sensitive database information by injecting SQL commands into the "sername" parameter.
CVE-2020-7270
PUBLISHED: 2021-04-15
Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensitive unencrypted information via a carefully crafted HTTP request parameter. The risk is partially mitigated if your ATD instances are deploye...