Cyber Security Organizational Implications

Cyber Security Organizational Implications:
Introduction
In the global environment with continuous network connectivity, the possibility for
cyber attacks can emanate from sources that are local, remote, domestic or foreign. They could
be launched by an individual or a group.
A “security breach” is defined as unauthorized acquisition of data that compromises security,

confidentiality or integrity of personal information (PI).
Personal Information (PI) is information that is, or can be, about or related to an identifiable
individual. It includes any information that can be linked to an individual or used to directly or
indirectly identify an individual. For example, Pi is an individual’s first name or last name and/or
in combination with any of the following data:
1. Social security number/ Social insurance number

2. Driver’s licence number or identification card number
3. Bank account number, credit or debit card number with personal identification
number such as an access code,security code or password that would permit access
to an individuals financial account.
4. Home address or e- Mail address
5. Medical or health Informaion
An Insider threat is defined as “the misuse or destruction of sensitive or confidential

information, as well as IT equipment that houses this data by employees, contractors and other
trusted individuals”.
Insider threats can caused by human actions such as mistakes, negligence, reckless
behaviour, theft, fraud and even sabotage. There are three types of individuals such as:
1. A malicious insider is motivated to impact an organization through a range of actions

that compromise information confidentiality, Integrity and/or availability.
2. A careless insider can bring about a data compromise not by any bad intention but
simply by being careless due to an accident, mistake or plain negligence.
3. A tricked insider is a person who is tricked into or led to providing sensitive or
private company data by people who are not truthful about their identity or pupose
via “pretexting”(known as social engineering).
Insider Attack Example: Heartland Payment System Fraud
A case known as “Heartland Payment System fraud” that was took place in January 2010
which showcase the seriousness of “Insider attacks”. In this case, the concerned organization
suffered a serious blow through nearly 100 million credit cards compromised from at least 650
financial services companies. When a card is used to make a purchase, the card information is
transmitted through a payment network. In this case a piece of malicious software (malware,
i.e., a “keystroke logger”) planted on the company’s payment processing network, recorded
payment card data as it was being sent for processing to Heartland by thousands of the
company’s retail clients. Digital information within the magnetic stripe on the back of credit and
debit cards was copied by key logger. Perpetrators created counterfeit credit cards.
Unfortunately, these “break - ins” went undetected for nearly 6 months.
Insider Attack Example: Blue Shield Blue Cross (BCBS)
Yet another incident is the Blue Shield Blue Cross (BCBS) Data breach in October 2009-
the theft of 57 hard drives from a blue cross blue shield of Tennessee training facility puts the
private information of approx. 5,00,000 customers at risk in at least 32 states. The hard drives
containing 1.3 million audio files and 3,00,000 video files related to coordination of care and
eligibility telephone calls from providers and members were reportedly stolen from a leased
office. Three hard drives were physically removed from server racks on computers inside data
storage closet at a training center. Incidents such as these bring out glaring point about physical
security weakness at organizations. The two lessons to be learnt from this are,
1. Physical security is very important

2. Insider threats cannot be ignored
Note: Cybercrimes do not happen on their own or in isolation. Cyber crimes take place due to
weakness of cyber security practices and privacy which may get impacted when cybercrimes
happen.
Privacy has the following four key dimensions:
1. Informational/data privacy – it’s about data protection

2. Personal privacy – it’s about content filtering and other mechanisms to ensure that
the end-users are not exposed to whatever violates their moral sense
3. Communication privacy – This is in networks, where encryption of data being
transmitted is important
4. Territorial privacy – It’s about protecting users property. Ex: User devices from being
invaded by undesired content such as SMS or E-mail/Spam messages
The key challenges from emerging new information threats to an organization are,
1. Industrial espionage: These are some tools available for web administrators to
monitor and track the various pages and objects that are accessed on their website.
Ex: Competitor who come to know about their co-competitor by analyzing the
firewall and IDS.
2. IP – based blocking: This process is often used for blocking the access of specific IP
addresses and/or domain names. Ex: Blocking the websites from competitors.
3. IP – based “Cloaking”: Business are gloabal in nature and economies are
interconnected. There are websites that change their online content depending on a
users IP addess or user geographical location. Ex: Let us say, your competitor web
tool recognizes one of your technical employees surfing its site and to mislead him it
displays incorrect or inaccurate product information to your IP address, thus making
it imposibble to obtain accurate competitive information.
4. Cyberterrorism: It refers to the direct intervention of a threat source toward your
organization website.
5. Confidential Information Leakage: An external threat can be protected via
firewall/antivirus/IDS etc. But it’s very difficult in case of internal/insider attack. Ex:
Insider attacks
Cost of Cybercrimes and IPR Issues: Cyber crimes cost a lot to the Organizations. When a
cyber crime incidents occurs, there are a number of internal costs associated with it for
organizations and there are organizational impacts as well.
Detection and recovery constitute a very large percentage of internal costs. Its the
frequency of cybercrimes along with its success (i.e., bypassing one’s firewall and IDS’s)
together that become a key reason for organizations to worry about the cost of cybercrimes.
Information theft represents the highest external cost.
Organizations Internal Costs Consequences and Notional costs
Associated with them
Cost of Detection Information loss or data theft
Business disruption
Cost of Investigation
and Escalation Costs associated
with cybercrime Damage to property plant
and equipment
Cost of containment
Loss of revenue
Cost of Recovery
Damage to brand image

Post-response costs
Figure: Cost of Cybercrimes
Organizations have Internal Costs Associated with Cyber security Incidents: The internal costs involve
people costs, overhead costs and productivity losses. The internal costs shown in above figure are in
order from largest to the lowest.
1. Detection Costs (25% - Largest)

2. Recovery Costs (21%)
3. Post-response costs (19%)
4. Investigation Costs (14%)
5. Cost of Escalation and Incident Management (12%)
6. Cost of Containment (9% - Lowest)
Similarly, the consequences of cyber crimes and their associated costs include,
1. Information loss/data theft ( Highest – 42%)

2. Business Disruption (22%)
3. Damage to property plant and equipment (13%)
4. Loss of revenue and tarnishing (13%)
5. Other costs (10%)
Organizations impacted by various types of cyber crimes include,
1. Viruses, worms and Trojans (100%)

2. Malware (80%)
3. Botnets (73%)
4. Web – based attacks (53%)
5. Phishing and social engineering (47%)
6. Stolen devices (36%)
7. Malicious Insiders (29%)
8. Malicious Code (27%)
When the data for “average days taken to resolve cyber attacks” was formulated according to the cyber
attack categories,
1. Attack by malicious insiders (42 days – Highest)

2. Malicious code (39 days)
3. Web – based attacks (19 days)
4. Data loss due to stolen devices (10 days)
5. Phishing and social engineering attacks (9 days)
6. Virus, worms and Trojans (2.5 days)
7. Malware (2 days)
8. Botnets (2 days)
Again their counter- measures to be followed are,
1. End point protection: Ex: IP based printers

2. Secure Coding
3. HR checks
4. Access Controls Ex: Shared IDs and Shared laptops. Access privileges should be granted
carefully.
5. Importance of security governance: It can’t be ignored like policies, procedures and their
effective implementations.
Organizational Implications of Software Piracy:
From a legal standpoint, software piracy is an IPR violation crime. Use of pirated software
increases serious threats and risks of cyber crime.

Cyber Security Organizational Implications

Uploaded by

Copyright:

Available Formats

Cyber Security Organizational Implications

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Cyber Security Organizational Implications

Uploaded by

Copyright:

Available Formats

Cyber Security Organizational Implications:

A “security breach” is defined as unauthorized acquisition of data that compromises security,

1. Social security number/ Social insurance number

An Insider threat is defined as “the misuse or destruction of sensitive or confidential

1. A malicious insider is motivated to impact an organization through a range of actions

Insider Attack Example: Blue Shield Blue Cross (BCBS)

1. Physical security is very important

Privacy has the following four key dimensions:

1. Informational/data privacy – it’s about data protection

Cost of Detection Information loss or data theft

Damage to brand image

Figure: Cost of Cybercrimes

1. Detection Costs (25% - Largest)

1. Information loss/data theft ( Highest – 42%)

Organizations impacted by various types of cyber crimes include,

1. Viruses, worms and Trojans (100%)

1. Attack by malicious insiders (42 days – Highest)

Again their counter- measures to be followed are,

1. End point protection: Ex: IP based printers

Organizational Implications of Software Piracy:

You might also like