Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

12/27/2017
10:30 AM
Anand Paturi
Anand Paturi
Commentary
100%
0%

The Financial Impact of Cyber Threats

Determining the financial impact of specific IT vulnerabilities is a good way to prioritize remediation and prevent attacks.

The WannaCry and NotPetya ransomware epidemics demonstrated how quickly malware can spread across the globe and cripple businesses. Their impact extended beyond traditional IT infrastructure into operational systems used to control industrial, manufacturing, and critical infrastructures. The scale of these incidents is forcing organizations to consider the financial impact and business exposure associated with cyber threats, to better mitigate risk.

As in most cases, these attacks were made possible by poor operational security procedures (or lack of them), because the vulnerabilities they exploited, and the patches that protected against them, had been disclosed months earlier.

What's lacking in many organizations is smart prioritization of vulnerability remediation efforts. One efficient way to accomplish this is by determining financial impacts posed by specific vulnerabilities that exist in the IT infrastructure.

Records-Based Exposure Models Are Inaccurate
Traditionally, financial impacts are estimated based on the number of personally identifiable information records that could be breached or exfiltrated during a cyber attack. This data is fed into business impact analysis systems or risk frameworks like FAIR to extract business exposure.

However, considering only data loss scenarios while determining financial effects does not provide a comprehensive assessment, because data breaches are not always involved in massive attacks. For example, the WannaCry and Petya ransomware outbreaks encrypted but did not exfiltrate data.

Therefore, when calculating the financial impact of cyber threats, you must consider the following factors: (a) revenue loss resulting from downtime, (b) staff time required for post-incident analysis, (c) infrastructure damage and the cost to implement compensation controls, and (d) post-attack notification and legal costs.

Threat-Centric Models Are More Reliable
To do this, organizations should assess their business exposure to individual cyber threats. This can be achieved through adversary modeling, using tactic, technique, and attack pattern frameworks.

CAPEC (Common Attack Pattern Enumeration and Classification) is an open attack pattern categorization framework that enables analysts to determine different attack patterns applicable to high-risk vulnerabilities. When a threat's attack patterns are mapped to assets on which the high-risk vulnerability is present, a comprehensive business exposure can be derived.

As an illustration, let's apply CAPEC to the EternalBlue exploit used in the WannaCry and NotPetya attacks to assess its financial impact on a generic organization.

The EternalBlue exploit starts with an integer overflow (CAPEC-92) that runs arbitrary code on target systems to cause a buffer overflow (CAPEC-100) in order to hijack a privilege thread in a system process. This ultimately leads to hijacking a privileged thread of execution (CAPEC-30). Though the likelihood of exploit for CAPEC-30 is low, its severity is critical and results in running unauthorized commands by gaining privileges or assuming identity.

Applying CAPEC analysis to EternalBlue reveals the tactics that adversaries can implement on target systems vulnerable to that exploit and their outcomes (i.e., gaining privilege and executing unauthorized commands).

Because the adversary modeling for EternalBlue is known, the operational impact of vulnerabilities (susceptible to EternalBlue) on the target organization is clear. With this knowledge, it's possible to estimate the business exposure resulting from those vulnerabilities.

For example, if vulnerabilities that are susceptible to EternalBlue exist on an organization's file server, then we know arbitrary commands can be executed to tamper with the files on that machine. Which, in the WannaCry and NotPetya attacks, involved encrypting the files to elicit a ransom payment.

Predicting Financial Losses
Next, based on the organization's business dependency on those files, we can use their unavailability as a factor to determine the financial loss that would result if they were compromised by a ransomware attack.

Traditionally, cybersecurity risk is calculated using this formula:

likelihood X impact = risk

The following modified version of this formula can be used to derive the financial effects based on a risk assessment:

likelihood X criticality X f (impact analysis) = financial impact

It can be applied against each vulnerability discovered during a risk assessment to estimate their individual financial impacts, which may be different.

Likelihood is a single point value derived as a probability measure based on cybersecurity intelligence or algorithms. This represents the likelihood of a given vulnerability will be successfully exploited. Some of the sources that can be used to derive likelihood include:

  • Threats applicable to the vulnerability
  • Patches available versus applied to the vulnerability
  • Tactic applicable after exploiting the vulnerability
  • Ease of exploitability

Criticality is a single point value that represents the criticality to the business of the asset on which the particular vulnerability exists.

And f (impact analysis) is a function that combines the monetary loss resulting from a successful cyberattack. The list of factors on which the monetary loss should be calculated is listed above. One of the leading criteria for determining monetary loss is the severity and impact of the tactic that is applicable to the vulnerability. For example, a remote command execution tactic would generate a high loss in terms of monetary value. 

By assessing the financial effects of individual cyber threats, organizations can more effectively prioritize remediation efforts, align security resources to protect their most critical assets, and allocate new investments to initiatives that will limit the business impact of attacks.

Related Content:

Anand Paturi is Senior Research Scientist at RiskSense, a provider of cybersecurity risk management technology. He is an expert in Web application and database security, risk exposure and threat-centric vulnerability quantification, and enterprise risk analytics. Anand is ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3035
PUBLISHED: 2021-04-20
An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.26. Checkov 1.0 versions are not impacted.
CVE-2021-3036
PUBLISHED: 2021-04-20
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in cleartext to the web server logs when the API is used incorrectly. This vulnerability applies only to PAN-OS appliances that are configured to us...
CVE-2021-3037
PUBLISHED: 2021-04-20
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and IP address used to export the PAN-OS conf...
CVE-2021-3038
PUBLISHED: 2021-04-20
A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect app on Windows systems allows a limited Windows user to send specifically-crafted input to the GlobalProtect app that results in a Windows blue screen of death (BSOD) error. This issue impacts: GlobalProtect app 5.1 versions...
CVE-2021-3506
PUBLISHED: 2021-04-19
An out-of-bounds (OOB) memory access flaw was found in fs/f2fs/node.c in the f2fs module in the Linux kernel in versions before 5.12.0-rc4. A bounds check failure allows a local attacker to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The hi...