Cyber Security Doesn't Have To Be Complex Part3

welcome back to another episode of cappuccino chat this time part three of why cyber security doesn't have to be complex and confusing that's Insurance to replace your car if it's stolen and insurance to repair your car if it's damaged in an accident but you know that your biggest Financial Risk is medical costs not property damage so you want Insurance to protect you from the liability of hurting someone on the road collision insurance liability insurance the good stuff not some cheap policy from an unknown Insurance Company they'll pay for a tow truck if your car breaks down or you get a flat tire they'll pay for a rental car while your car is getting repaired you're trying to do everything right but you know that no one completely eliminate the possibility of a Cyber attack just like professional car thieves professional hackers can access almost anything remember the examples in Eric O'Neill's presentation if China or Russia or North Korea comes after your technology they're probably going to win just like Vin Diesel deciding to steal your car there are some criminals that you aren't going to stop you know that you can reduce the probability of attack you can make yourself less of a Target but you can't guarantee your company's safety as Gene spafford a computer science professor at Purdue sarcastically explains the only true secure system is one that is powered off cast in a block of concrete and sealed in a lead-lined room with armed guards you can't run your business that way so you hire a competent and trustworthy managed service provider who also has experience and expertise in cyber security and you work with them to choose a good cyber insurance policy smart business owners understand the importance of insurance currently 32 percent of companies have purchased cyber liability coverage has Rusty Goodwin from the Mid-State group explains a mature risk posture is achieved with security insurance and compliance all three layers are critical and you want multiple layers of security but you also need other layers of protection in addition to that security you also need insurance and compliance so how can cyber Insurance help you let's take a look at an example from Texas a local pizza restaurant had a disgruntled employee we can all relate how many of us have had unhappy employees over the years the employee used access to the company's email system to create a new fake employee with their outside payroll service provider then they authorize the very large check to be deposited into their account however the payroll provider had procedures in place to prevent this exact type of attack when a new employee was added to the system the first check wouldn't be directly deposited into the employee's account a paper check would be created instead reviewed and then mailed out during the review process the fake account was discovered and the payment was never sent Dr Larry Pullman found that this type of internal attack is becoming even more common we discovered in our research that Insider threats are not viewed as seriously as external threats like a Cyber attack but when companies had an Insider threat in general they were much more costly than external incidents this was largely because The Insider that is smart has the skills to hide the crime for months years and sometimes forever that's not the end of the story when the pizza place found out about the hack they sued their payroll provider for mismanagement now in order to defend themselves from the lawsuit the payroll company paid almost fifty thousand dollars for a forensic audit and demonstrated that they had done nothing wrong they had followed all their proper procedures and avoided a potential loss for the pizza restaurant the audit also revealed that the pizza restaurant had been negligent in an insufficient cylinder security processes this allowed the employee to access the payroll system the cost of the audit was paid by the payroll company's insurance provider and this process was important to protect the company's reputation if customers believe that the payroll company was unreliable then they wouldn't be able to continue to build their business and they would rapidly lose their existing customers and this is just not about protecting your reputation with customers protecting your reputation with investors or potential buyers is also important now Malcolm Marshall Global head of cyber security at KPMG warns that investors see data breaches as a threat to a company's material value and feel discouraged and investing in a business that has had its sensitive information compromised