Business Risks and Cyber Attacks

Published: 2013-08-19. Last Updated: 2013-08-19 12:55:13 UTC
by Guy Bruneau (Version: 1)
1 comment(s)

According to LLoyd's (An insurance market company) latest survey, it ranks Cyber Risk as the number three overall risks amongst 500 senior business leaders it surveyed. "It appears that businesses across the world have encountered a partial reality check about the degree of cyber risk. Their sense of preparedness to deal with the level of risk, however, still appears remarkably complacent."[1]

Last year, several well know companies experienced significant breaches such as Yahoo, Verison, Twitter, Google where thousands of users were required to change their passwords. Some of the changes implemented since then include two-factor authentication by Google and Apple to name a few.

Do you think that business executives are more aware now of the reality of cyber attacks?

[1] http://www.lloyds.com/news-and-insight/risk-insight/lloyds-risk-index/top-five-risks
[2] https://isc.sans.edu/diary/Twitter+Confirms+Compromise+of+Approximately+250%2C000+Users/15064
[3] https://isc.sans.edu/diary/Verizon+Data+Breach+report+has+been+released/15665
[4] https://isc.sans.edu/diary/Apple+ID+Two-step+Verification+Now+Available+in+some+Countries/15463

-----------

Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu

Keywords: Cyber Attacks Risks
1 comment(s)

Comments

I can only answer so far as my current $DAYJOB goes. In that case, I'd say that the execs are becoming more aware of the risks and becoming more security-conscious. But I think it's only partly because of recent, splashy compromises. We've also started doing more monitoring of network traffic (internal traffic between major offices and VPN clients and traffic between "inside" and "outside" networks) with tools like snort and a few commercial appliances we've been trying out. I suspect that at least part of the increased security awareness is from these monitoring efforts showing compromises that all of the anti-virus tools, firewalls, etc weren't able to prevent (you know - the "you can't patch stupid" problem we all face to some degree - grin).

In my past experience, splashy compromises sometimes make it easier to get budget to buy some appliance to "check the security box" in the minds of the execs, but getting budget for someone to spend time managing the appliance and/or auditing what it finds and/or getting support from the execs on changing corporate policies because of what's being found is harder.

Anyway, it's nice to be working at a place where management is asking "what can we do to be more secure" rather than things like "Isn't my running <whatever_antivirus> enough?" :-)

Anonymous

Aug 19th 2013
1 decade ago

Login here to join the discussion.


Top of page
Diary Archives