Vulnerabilities / Threats

8/16/2017
02:00 PM
Tom Kellermann
Tom Kellermann
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

The Day of Reckoning: Cybercrimes Impact on Brand

Why the security industry needs to invest in architecture that defends against reputational damage as well as other, more traditional threats.

American cyberspace has become a brave new world. The second quarter of 2017 ushered in a wave of cyber attacks, many of which directly impacted the operational and reputational risk of multinational corporations. FedEx Corp, Danish shipping company AP Moller-Maersk S/A are among six corporations which reported financial damage from cyber attacks last quarter, according to the Poneman Institute, which also projects collateral damage associated with these attacks will surpass the cost of the loss of customer data by year end. 

This new face of cybercrime directly impacts a corporation’s reputation. Recently Oxford Economics, which studied severe breaches at 65 listed companies, found that breaches tend to lead to share prices falling by an average of 1.8%.   

Major breaches over the past decade have also forced a consensus that compliance with security standards does not equate to cybersecurity. Consequently, security awareness within the C-suite is paramount for mitigating cyber-risk. But if responsibility to protect brands from cyber threats extends beyond those in technology, whose responsibility is it to protect the brand - the IT department or the marketing department? According to a study by Ponemon and Centrify released in February, 66% of IT practitioners do not think that brand protection is their responsibility while 45% of IT practitioners and 42% of CMOs believe that brand protection is not taken seriously by the C-suite. A full 71% of CMOs believe the biggest cost of a security incident is the loss of brand value; nearly half of the IT practitioners surveyed (49%) report brand diminishment as the biggest loss, according to the study. 

What do the consumers think about security? According to Ponemon, 31% of consumers will discontinue a relationship due to a data breach, but even higher numbers - 65% - will lose trust in the company. While IT professionals and CMOs agree that brand protection is directly impacted by cyber attacks, there is a disconnect about who should allocate resources to mitigate intrusions. According to a recent survey of chief marketing officers, CMOs currently oversee 11% of a corporation’s budget, most of which is allocated to digital marketing campaigns. It is imperative that a percentage of these monies be reallocated to cybersecurity. 

How Cybercrime is Metastasizing

Avoiding a network breach is a corporation’s ultimate measure of cybersecurity success, though the supposition that an adversary is already on one’s network is foundational for mitigating cybercrime. When a breach occurs, the exfiltration process is not immediate — a hacker must maneuver, explore, and collect information before she finds that which is valuable. Gone are the days of smash and grab cyber burglaries. Cybercriminals have transitioned from burglary to home invasion.

The more dwell time the adversary has in the environment, the longer it takes to detect and contain a data breach, the more costly it becomes to resolve, and the harder a brand’s reputation is hit. Victim organizations are experiencing multiple criminal schemes of monetization. Data is stolen and subsequently the brand is used against its constituency via watering hole attacks and business email compromise campaigns. In our ever more connected world, reputational risk has metastasized in 2017.

This explosion further illustrates the formidable dark side of globalization and cybercrime. As billions of people become connected, not all are ethical individuals.  The criminal world has migrated online; in the United Kingdom over 50% of crimes involve a cyber component, according to a 2016 National Crime Agency cybercrime assessment.

ROI of Brand Protection

The Ponemon Institute 2017 Cost of Data Breach Study diagnosed the relationship between the ROI associated with brand protection. The study calculates that costs of a data breach are in excess of $17 million. The cost breakdown takes into consideration customer turnover, amplified customer acquisition efforts, and general "reputation losses and diminished goodwill." The number one factor that impacts the cost is the time it takes to identify and contain a data breach. According to Ponemon, "the relationship between how quickly an organization can identify and contain data breach incidents impacts the financial consequences." 

The bottom line is that we must realize that there is a significant, unquantified loss associated with brand degradation, and that reputational risk management requires investing in a cybersecurity architecture that maximizes brand protection.

At the end of October, top experts on breaches and branding will be meeting with enterprise security professionals to explore the impact that data compromises may have on business. To find out more, go to Zero Day Con, and learn more about the direct correlation between cybersecurity investment and brand protection. 

Related Content:

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info and to register.

 

Tom is a cyber intelligence expert, author, professor, and leader in the field of cybersecurity.  Having held a seat on the Commission on Cyber Security for the 44th President of the United States and serving as an advisor to the International Cyber Security Protection ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12716
PUBLISHED: 2018-06-25
The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, which allows remote attackers to determine the physical location of most web browsers by leveraging the presence of one of these devices on its l...
CVE-2018-12705
PUBLISHED: 2018-06-24
DIGISOL DG-BR4000NG devices have XSS via the SSID (it is validated only on the client side).
CVE-2018-12706
PUBLISHED: 2018-06-24
DIGISOL DG-BR4000NG devices have a Buffer Overflow via a long Authorization HTTP header.
CVE-2018-12714
PUBLISHED: 2018-06-24
An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c could be called with no filter, which is an N=0 case when it expected at least one line to have been read, thus making the N-1 index invalid. This allows attackers to cause a denial o...
CVE-2018-12713
PUBLISHED: 2018-06-24
GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimp_write_and_read_file function in app/tests/test-xcf.c. This might be leveraged by attackers to overwrite files or read file content that was ...