What is your real RISK?

Threat is also a factor when calculating risk. What are the biggest threats you are facing? These range anywhere from natural disasters, corporate espionage, spies, disgruntled employees… Pretty much, if you are in any sort of business providing something that someone wants, then there is a good chance someone else wants to know what you know, or have what you have. Threats are the things that will do the damage to your organization.

Vulnerabilities are the entry point into the organization or enabling access to the information of value. Dealing with IT security, vulnerabilities can be exposure on the internet, easy access to the company network, or compromised client machines and servers. But vulnerabilities also include not checking everyone entering the building, unlock/unmonitored side entrances, losing or dropping information, or even a night out on the town with the executives. Never discount human error and ego. Drunk people like to talk and are not often aware of their surroundings. You never know when someone might be listening in on your conversations or going through the pockets of the coat that you checked in to the coatroom.

Made up Example:

Company X is a huge global company. They have offices and manufacturing spread all over the earth. They have grown very fast and have not kept up to date with their security (naughty naughty…). They of course have information that someone else might want, but also, they are a target just like every other business simply because they exist. What would happen if a small part of their business went down? Let’s say a region where they manufacture product Z. How many people would be affected? What would the costs be? Can we put a value on this attack? Yes, we can.

This hypothetical attack knocked out the region with a good old crypto locker that found its way in from a targeted phishing campaign and relied on out-of-date systems which are missing much needed security patches.

The first cost we are looking at is the loss of production of what ever it is they are manufacturing. Let’s say their daily output values at €1,000,000 and they were down for 2 weeks! That is €10-14,000,000 in losses (depending on if they get the weekends off). And they are now behind so when they start again, they might need to increase their production to make up for that. But that is not the only cost at all. There will no doubt be people working around the clock to stop the attack, try to fix it and figure out what went wrong. Let’s just say that around 100 people were working like crazy for one month to contain and fix this so production could begin again. 100 people with an average cost of (lets estimate) €50/hour for the company, for 10 hours a day. That is an additional cost of €1,500,000! Just in people trying to contain this incident. Other costs could include replacement of equipment that might have been damaged.