Cybersecurity - Cyber Incident Impact

When there is some sort of problem or incident on our networks and our technologies, it exposes us, and that exposure has an impact.

We looked at the CIA triad, and how confidentiality, integrity and availability is the main focus of a cybersecurity program. But what happens when one of these fails and we don't have confidentiality, integrity or availability? What is the impact to the rest of the company?

The Impacts

One impact that this could have is a loss of revenue. If you're operating an e-commerce site and that e-commerce site goes down, customers can't purchase your products, and at that point in time you're losing revenue for the period of time that that site is down.

Another thing is loss of assets. This could be equipment, it could be money. Let's say there's some sort of phishing campaign and people start stealing money from your employees — that's a loss of assets right there.

There could be judgments and fines. What's happening is, because cybersecurity is becoming so much more prevalent, governments now are stepping in and requiring much more stringent guidelines and things that you have to follow, and if you don't follow them, fines are going to become more prevalent.

Another thing is notification and mitigation. When you have a security breach, you have to notify your customers and let them know that something has happened. Well, there's a cost to that. And then you have to fix whatever is broken, whatever has happened, and so there's a cost to that.

Or perhaps somebody has broken into your company and they've stolen company secrets. Well, you're going to have a loss of competitive advantage. Let's say you have a trade secret that only your company is doing, and once that gets out there, that could be very damaging for the company.

There could be a loss of reputation. When all of this stuff happens, when you have downtime, when you're losing customers' data, what can happen is you have a loss of reputation, and that can be really damaging — one of the most damaging things to a company.

It could lead to loss of customers, and that could be something that is a snowball effect, where more and more customers start leaving you because of a security incident. In fact, after a security incident most companies don't survive. It's just a matter of time before they're going to go under because of the security incident, and then that leads to that loss of business. So that can certainly happen, and does happen a lot when it comes to cybersecurity incidents.

Availability Versus Confidentiality

One thing that happened earlier in my career is I really had a focus on availability. I didn't really ever have any issues with integrity, and the confidentiality part, I wasn't dealing with really sensitive information. So I had a big focus on availability, and one of the big reasons for that is because if some sort of service or our site was down, or something went down, I heard about it from my customers. They made sure that I was there fixing the issue, and so this seemed to be a real highlight when I was earlier in my career.

One thing I've noticed in my career is that as I progressed, I put a lot more emphasis on confidentiality than I used to. Here's a timeline that I'm going to use to illustrate this.

Let's say that there's an incident that happens that affects the availability of our website, so availability of our website goes down. During that time, customers are not happy, our users are not happy, other departments are not happy, my boss is not happy. It causes a lot of problems. But we get the website back up and running, and people are forgiving — as long as it's not consistently happening, people are forgiving of that. There is a bit of damage to your reputation that happens, a little bit, but you get it back up and running and things are better.

But if there was a breach in confidentiality — and maybe it's even a smaller breach right there, maybe it's just a small breach that happens with confidentiality — because of that small breach in confidentiality, information gets stolen. You have to go through a notification process, you've got to talk to lawyers, you've got to start massaging things over with your customers to make sure that they're happy with this. You never know if that information fully gets pulled back in. In fact, there is no way of knowing that. Once that information is out there, it's persistent, and so that can come back and haunt you for the rest of eternity, really. That information is out there, and so just a small little breach can cause so much headache with all of this.

So really, as much as you want your availability to be up, and you get a lot of complaints when it's not up, this confidentiality can be very devastating to a company.

My job as a cybersecurity specialist is to make sure that the company is protected, and so I am protecting the company against these impacts, and occasionally that actually falls outside that technology realm. So my job as a cybersecurity specialist is to keep the company safe from these impacts.