Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/24/2019
02:30 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

NormShield Enables Organizations to Calculate Potential Financial Impact of Cyberattacks on Suppliers, Partners

VIENNA, VA, September 24, 2019 – No matter how hardened a company’s cyber defenses are, significant risk remains when suppliers and third-party trading partners are attacked and compromised. Today, NormShield, the only provider of a standards-based external cyber risk assessment platform, unveiled the first-ever automated tool to combine and assess both cyber and financial risk.

Calculating the dollar value of the probable loss caused by an attack on a supplier or partner enables Chief Information Security Officers (CISOs), Chief Risk Officers (CROs) and Chief Financial Officers (CFO) to measure and mitigate cyber risk to business performance.

To measure the potential financial impact (risk) to an organization, NormShield uses the Factor Analysis of Information Risk (FAIR) Model, the only international standard Value at Risk (VaR) model for cybersecurity and operational risk.

“Incorporating the FAIR Model into cyber risk assessments enables organizations to effectively quantify the true financial cyber risk to their bottom lines,” said Mohamoud Jibrell, CEO of NormShield. “Companies now can have a three-dimensional view of the technical, compliance and financial impact of a cyberattack to better understand the full risk relationship with a partner or supplier. For some, the business benefits will outweigh the cyber risks but for others it may not.”

In financial services, for example, CISOs and CROs will be able to show the business that the threat of an attack on a vendor is real and gauge whether the odds are rising or falling. Further, CISOs and CROs can now show the business the financial impact of sharing fewer records with a vendor. The business can then determine which is greater, the reduction in probable costs from an attack on that vendor or the increase in revenue from sharing more records with that vendor.

A company’s vendors have different levels of importance. A vendor that does not have access to any systems or confidential data will have lower risk than that of a vendor that has access to PII data of company employees. The FAIR model allows NormShield to give a vendor business impact (Loss Magnitude) in risk calculation – from both the technical and financial perspectives.

“Every dollar spent on cyber risk management is a dollar that can’t be spent growing the business or addressing other organization imperatives,” said Jack Jones, chief risk scientist for RiskLens. “Consequently, cost-effective cyber risk management — knowing what matters most, and getting the best bang for your risk management buck — is a necessary cornerstone of organization success.”

The FAIR methodology was conceived as a way to provide meaningful measurements to satisfy management's desire to make effective comparisons and well-informed decisions. FAIR has become the only international standard Value at Risk (VaR) model for cybersecurity and operational risk.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
COVID-19: Latest Security News & Commentary
Dark Reading Staff 4/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11586
PUBLISHED: 2020-04-06
An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that contains malicious XML DTD data.
CVE-2020-11587
PUBLISHED: 2020-04-06
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and get the content of ETL Processes running on the server.
CVE-2020-11589
PUBLISHED: 2020-04-06
An Insecure Direct Object Reference issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make a GET request to a certain URL and obtain information that should be provided to authenticated users only.
CVE-2020-11590
PUBLISHED: 2020-04-06
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to HealthPage.aspx and obtain the internal server name.
CVE-2020-11591
PUBLISHED: 2020-04-06
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the full application path along with the customer name.