Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/24/2019
02:30 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

NormShield Enables Organizations to Calculate Potential Financial Impact of Cyberattacks on Suppliers, Partners

VIENNA, VA, September 24, 2019 – No matter how hardened a company’s cyber defenses are, significant risk remains when suppliers and third-party trading partners are attacked and compromised. Today, NormShield, the only provider of a standards-based external cyber risk assessment platform, unveiled the first-ever automated tool to combine and assess both cyber and financial risk.

Calculating the dollar value of the probable loss caused by an attack on a supplier or partner enables Chief Information Security Officers (CISOs), Chief Risk Officers (CROs) and Chief Financial Officers (CFO) to measure and mitigate cyber risk to business performance.

To measure the potential financial impact (risk) to an organization, NormShield uses the Factor Analysis of Information Risk (FAIR) Model, the only international standard Value at Risk (VaR) model for cybersecurity and operational risk.

“Incorporating the FAIR Model into cyber risk assessments enables organizations to effectively quantify the true financial cyber risk to their bottom lines,” said Mohamoud Jibrell, CEO of NormShield. “Companies now can have a three-dimensional view of the technical, compliance and financial impact of a cyberattack to better understand the full risk relationship with a partner or supplier. For some, the business benefits will outweigh the cyber risks but for others it may not.”

In financial services, for example, CISOs and CROs will be able to show the business that the threat of an attack on a vendor is real and gauge whether the odds are rising or falling. Further, CISOs and CROs can now show the business the financial impact of sharing fewer records with a vendor. The business can then determine which is greater, the reduction in probable costs from an attack on that vendor or the increase in revenue from sharing more records with that vendor.

A company’s vendors have different levels of importance. A vendor that does not have access to any systems or confidential data will have lower risk than that of a vendor that has access to PII data of company employees. The FAIR model allows NormShield to give a vendor business impact (Loss Magnitude) in risk calculation – from both the technical and financial perspectives.

“Every dollar spent on cyber risk management is a dollar that can’t be spent growing the business or addressing other organization imperatives,” said Jack Jones, chief risk scientist for RiskLens. “Consequently, cost-effective cyber risk management — knowing what matters most, and getting the best bang for your risk management buck — is a necessary cornerstone of organization success.”

The FAIR methodology was conceived as a way to provide meaningful measurements to satisfy management's desire to make effective comparisons and well-informed decisions. FAIR has become the only international standard Value at Risk (VaR) model for cybersecurity and operational risk.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-12512
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting
CVE-2020-12513
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.
CVE-2020-12514
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd
CVE-2020-12525
PUBLISHED: 2021-01-22
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
CVE-2020-12511
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the web interface.