1. Enable everyone to weigh cyber as part of their decision making. When folks are trying to make a decision, I want to ensure that the context of cybersecurity is part of that decision framework. They need to weigh the risks and everything else that comes with it as part of that decision. It has to be a calculated decision rather than something that you just go ahead with, only to realize you have to worry about cybersecurity after the fact.
2. Minimize the financial impact from cyber incidents. We all know we can't stop them from ever happening again; people find their way around. If you're doing all the right things, you can mitigate and minimize the impact, particularly the financial impact. And I specify financial impact because you often need something that's measurable and there's always a dollar number you can ascribe. It could be soft dollars or just resource times. And if those things are happening frequently, you have an underlying issue that you need to solve for. If you're reducing those problems, you're already doing everything correctly to save you time, money and resources in responding to cyber issues. You're doing security preventively.
I agree with you on that point. In my former role at Intel, they could tell you what the cost per hour was if a fab was offline. If the fab is offline, then you're not manufacturing processors and you can't sell what you don't make. So that was an interesting, eye-opening experience when I found out what those numbers were like.
It’s similar at the bank, because if there's a denial of service attack against the bank and the attackers take out the credit card processing, online banking, or our ability to conduct trades through our wealth management division, the business will be able to tell you what they were expected to do during those time windows. That gives you a pretty hard number on what the impact was, and then adding in the time and effort to recover from it gets you pretty close.
The other side is productivity. I was taking care of labs and the problem was that we had these million dollar robots processing all the samples hooked up to a Windows 95 or a Windows 98 machine, that we weren’t allowed to patch. We couldn’t put AV on anything; it would break the firmware of that machine if we did because that's how it was validated. Some of those machines in the lab had a shared username and password, and at some point a janitor got onto one of them and visited an insecure, explicit website. That machine got infected as a result, which then caused the whole lab to get infected.
And the problem is it's not as easy as rebuilding the PC after that, because every single one is validated. You have to get the vendor of each robot to come out, replace the machine and get the firmware set up, which only takes a week. But because the re-validation process takes another four to six weeks, our lab was down. This was a certified lab running samples and we were down for six weeks. We had to come up with a new way to protect those machines in case one got hit. So even before I was in security, I was still running security but we just had VLANs. That's the best we could do: put each lab machine in it’s own VLAN.
Content you might like
Yes - Maine did the right thing. There are too many security risks with free versions of these tools. Not enough copyright or privacy protections of data.31%
No, but.... - You must have good security and privacy policies in place for ChatGPT (and other GenAI apps). My organization has policies and meaningful ways to enforce those policies and procedures for staff.52%
No - Bans simply don't work. Even without policies, this action hurts innovation and sends the wrong message to staff and the world about our organization.12%
I'm not sure. This action by Maine makes me think. Let me get back to you in a few weeks (or months).3%
Most of the time the legals and or DPO don't have the technical acumen to understand when data is floating to third party services.
Lets ...read more
1Password20%
OneLogin41%
LastPass24%
BitWarden3%
Other (comment below!)12%
organized a virtual escape room via https://www.puzzlebreak.us/ - even though his team lost it was a fun subtitue for just a "virtual happy hour"