Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/24/2019
02:30 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

NormShield Enables Organizations to Calculate Potential Financial Impact of Cyberattacks on Suppliers, Partners

VIENNA, VA, September 24, 2019 – No matter how hardened a company’s cyber defenses are, significant risk remains when suppliers and third-party trading partners are attacked and compromised. Today, NormShield, the only provider of a standards-based external cyber risk assessment platform, unveiled the first-ever automated tool to combine and assess both cyber and financial risk.

Calculating the dollar value of the probable loss caused by an attack on a supplier or partner enables Chief Information Security Officers (CISOs), Chief Risk Officers (CROs) and Chief Financial Officers (CFO) to measure and mitigate cyber risk to business performance.

To measure the potential financial impact (risk) to an organization, NormShield uses the Factor Analysis of Information Risk (FAIR) Model, the only international standard Value at Risk (VaR) model for cybersecurity and operational risk.

“Incorporating the FAIR Model into cyber risk assessments enables organizations to effectively quantify the true financial cyber risk to their bottom lines,” said Mohamoud Jibrell, CEO of NormShield. “Companies now can have a three-dimensional view of the technical, compliance and financial impact of a cyberattack to better understand the full risk relationship with a partner or supplier. For some, the business benefits will outweigh the cyber risks but for others it may not.”

In financial services, for example, CISOs and CROs will be able to show the business that the threat of an attack on a vendor is real and gauge whether the odds are rising or falling. Further, CISOs and CROs can now show the business the financial impact of sharing fewer records with a vendor. The business can then determine which is greater, the reduction in probable costs from an attack on that vendor or the increase in revenue from sharing more records with that vendor.

A company’s vendors have different levels of importance. A vendor that does not have access to any systems or confidential data will have lower risk than that of a vendor that has access to PII data of company employees. The FAIR model allows NormShield to give a vendor business impact (Loss Magnitude) in risk calculation – from both the technical and financial perspectives.

“Every dollar spent on cyber risk management is a dollar that can’t be spent growing the business or addressing other organization imperatives,” said Jack Jones, chief risk scientist for RiskLens. “Consequently, cost-effective cyber risk management — knowing what matters most, and getting the best bang for your risk management buck — is a necessary cornerstone of organization success.”

The FAIR methodology was conceived as a way to provide meaningful measurements to satisfy management's desire to make effective comparisons and well-informed decisions. FAIR has become the only international standard Value at Risk (VaR) model for cybersecurity and operational risk.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/22/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Is Zero Trust the Best Answer to the COVID-19 Lockdown?
Dan Blum, Cybersecurity & Risk Management Strategist,  5/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13485
PUBLISHED: 2020-05-25
The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.
CVE-2020-13486
PUBLISHED: 2020-05-25
The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection.
CVE-2020-13482
PUBLISHED: 2020-05-25
EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
CVE-2020-13458
PUBLISHED: 2020-05-25
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action.
CVE-2020-13459
PUBLISHED: 2020-05-25
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action.