By James R. Lint
Faculty Member, School of Business, American Military University
Contributor, In Homeland Security
A few weeks after three cybersecurity conventions occurred in Las Vegas, AASIM Cyber Group (ACG) hosted ‘Lunch and Learn’ events at The Innevation Center in Las Vegas. One event was a cybersecurity awareness seminar.
These Lunch and Learns follow one of ACG’s interesting mottos, “Would you know if you were under a cyber attack? How much is not knowing costing you?” For managers, employees and IT office workers, these questions about cyber threats are often hard to answer.
Cybersecurity Expert Paul Abruzzo Offers Disturbing Picture of Cyber Threats and Costs
Paul Abruzzo, VP of Innovative Engineering, Equiinet, Inc. presented at the August Lunch and Learn. He discussed some cyber threats and recent cyber news.
Mr. Abruzzo started his speech with statistics designed to get attendees’ attention:
- The average total cost of a computer network breach is $4 million. This is up 29% since 2013.
- The average cost per record breached is $158.
- The average cost per record for a healthcare breach was $322, while the cost per record for the retail industry was $172. Transportation sector breaches costs were only $129 per record.
- Costs continue to climb because 48% of breaches are malicious attacks, which are more expensive to remediate.
- Costs due to lost business are getting higher; customer attrition is to 2.9% after a breach. Think of companies with small profit margins losing almost 3% of their business.
- Equiinet believes that there is 26% likelihood of a breach happening to you over the next 24 months.
- In 2015, over half a billion personal information records were stolen or lost worldwide.
- 36% of breaches included medical records.
There were many security and cybersecurity professionals in attendance. Most of the attendees knew that the statistics related to cyber threats would be bad.
But Mr. Abruzzo brought home the magnitude of this security issue. Many cybersecurity professionals cannot articulate current and up-to-date research on the statistics in their field to their management executives. This inability to clearly communicate the seriousness of a cybersecurity problem to upper-level management is a troubling problem.
Cyber Threats Come from Different Sources
There are a variety of cyber threats that cause cybersecurity or IT incidents. These threats range from spear phishing to the current trend in highly publicized ransomware news events, and well-known but unpatched software vulnerabilities.
Spear phishing comes in many varieties. Normally, the victim receives an email with a hyperlink to a malicious website and a request to click on the link for more information. After the unsuspecting victim clicks the link, he or she accidentally downloads software intended to harm a computer or network.
A new version of spear phishing is whale phishing. Whale phishing uses emails that are sent to more powerful individuals, such as managers and executives. The emails contain enough realistic, focused information to make the victims want to click on a link in their emails and unwittingly provide hackers with access to their computers. These emails deliberately target senior leadership to increase the size of the victory and the amount of information for hackers.
Ransomware has been in the news with hospitals and even police departments paying a ransom to receive the key to their encrypted computers or networks. Ransomware takes over a victim’s computer and locks up access to valuable data until the victim pays a financial ransom.
In some cases, hackers exploit security holes in the older software of computer networks. An example of a recent report of systems using old or unpatched software was recently reported in PC World magazine. In his article “U.S. government agencies are still using Windows 3.1, floppy disks and 1970s computers,” author Grant Gross stated:
“Some U.S. government agencies are using IT systems running Windows 3.1, the decades-old COBOL and Fortran programming languages, or computers from the 1970s. A backup nuclear control messaging system at the U.S. Department of Defense runs on an IBM Series 1 computer, first introduced in 1976, and uses eight-inch floppy disks, while the Internal Revenue Service’s master file of taxpayer data is written in assembly language code that’s more than five decades old, according to a new report from the Government Accountability Office.”
Remaining Vigilant and Communicating Threats Clearly Is Vital to Cybersecurity Professionals
The need to have a 360-degree awareness of cybersecurity and the potential for attacks to come from any direction is overwhelming nowadays. The ability for cybersecurity professionals to be able to articulate the threat to our computer systems and communicate in a coherent manner to management will always improve the professionalism of those who defend cybersecurity networks.
About the Author
James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded their 43rd scholarship for national security students and professionals. He has 38 years of experience in military intelligence within the U.S. Marine Corps, U.S. Army, contractor and civil service.
James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. In 2016 he was accepted as a member of the Military Writers Guild. He has served in the DHS Office of Intelligence and Analysis and at the Department of Energy’s S&S Security Office. James had an active military career in the Marine Corps for seven years and also served 14 years in the Army. His military assignments include South Korea, Germany and Cuba in addition to numerous CONUS locations. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” and a new book in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea.”
Comments are closed.