Don’t play cyber risk "dominos" with your business

Cybersecurity risks are critically challenging for businesses, with the potential to cause severe business disruption and financial impact.

Understanding the threats and how cyberattacks work can help you keep hackers at bay and better prepare and protect your business.

What is often not understood prior to a cyberattack is that the negative fallout of an incident can create a rapid downward spiral. As business becomes progressively impaired, reparation costs quickly escalate.

• The first domino — lost business cost. When websites or computer systems are attacked and taken offline, virtual storefronts may be rendered unusable by customers, and transactions may not be able to be processed. Though brick and mortar stores may still be open, with the virtual enterprise “closed,” customers and clients go elsewhere.

• The second domino — lost customers and reputation cost. If personal customer information (such as credit card numbers) is stolen, it shakes consumer confidence. A breach is often compounded by bad press, which can cripple brand reputation and lead to more devastating customer attrition.

• The third domino — restoration costs. After any cybersecurity incident, the tasks of restoring digital data, software, computer systems — and reputation — require money, time, personnel, and often costly external expert resources.

• The fourth domino — legal and settlement costs. When a cyber-attack negatively impacts customers, vendors, suppliers, or others there are often legal ramifications. Claims can be extremely costly and time consuming to defend.

When these dominos start to fall, the increasing costs may bring a business to the point of bankruptcy.

There are several ways that cyber criminals can gain access to a company’s website or internal server to steal data or otherwise attack a business. These include:

• Insufficiently securing electronic devices that have legitimate server access, such as computers or tablets.

• Exploitation of weak employee passwords or lax password precautions.

• Taking advantage of a power or internet service failure (that may or may not be caused by bad actors).

• Active attacks that exploit security flaws and often employ sophisticated malware or techniques, like ransomware, credential stuffing, and phishing.

Although stopping cyber criminals may seem like a formidable task, there are a handful of simple measures that companies can use to create their own cyber risk management program and limit their exposure.

• Update IT equipment and security software — Outdated operating systems and computers, outdated or unpatched software are easily breached by criminals.

• Diligently monitor networks — Abnormalities, if caught quickly, can limit company damage. A cybersecurity expert can identify high risk areas, and there are security software offerings that can offer monitoring solutions.

• Educate employees on cybersecurity vigilance — According to a Chubb survey, only 31% of respondents report that their employer provides them with annual company-wide trainings or updates*. Make sure your staff understands the important role they have in preventing a cyber breach and help them establish positive and secure habits with formal, enforced written cybersecurity policies and regular training.

• Require good password hygiene — This is an integral part of any cybersecurity policy. Passwords should be strong (e.g., a mix of letters, numbers, and symbols) and should be frequently changed. When employees leave the company, their passwords should be automatically revoked.

• Create a cyber incident response plan — If it’s within your team’s capabilities, some incidents can be mitigated with a prepared plan and a team of both internal and external cyber responders. With a strategy and experts in place, response to and resolution of an incident can occur more quickly.

• Purchase cyber insurance — While proactive measures are essential, a back-up plan is required to truly safeguard against any cyber risk. A good cyber insurance policy is more than just a financial loss mitigation tool — it can help a company understand how to prepare ahead of a potential cyberattack, and offer resources and partners, such as employee security trainers.