Hacked Companies Are Facing Data Breach Lawsuits Filed by Financial Institutions

Data breaches aren’t cheap to clean up. Just ask Rosen Hotels, whose costs to clean up a 2016 breach could end up exceeding $2.4 million. Shockingly, that’s below the $4 million average cited by IBM. In addition to direct costs, such as fines, labor to actually perform the cleanup, and bills from attorneys and PR firms, organizations are increasingly facing additional exposure in the form of data breach lawsuits – and not just from their customers.

Banks and credit unions, who must eat the losses when payment card numbers are stolen, are starting to fight back and demand reimbursement in the wake of POS system breaches. Fast-food chains Arby’s and Wendy’s, along with retailer Eddie Bauer, are facing class-action data breach lawsuits filed on behalf of financial institutions. Meanwhile, the Home Depot recently settled a similar suit for $25 million; this is in addition to the millions of dollars it is expected to pay for plaintiffs’ attorneys fees and the millions more it has already spent on fines and other cleanup costs.

Financial institutions aren’t the only parties that may file data breach lawsuits. Rosen Hotels is being sued by its commercial liability insurance company, which is alleging that Rosen’s policy did not cover data breaches. Additionally, the employee tax data phishing scam that was all the rage in 2016 reemerged just in time for the 2017 tax season, so the next round of lawsuits may stem from organizations’ own employees.

Preventing Breaches Is Far Cheaper Than Cleaning Them Up

Arby’s, Wendy’s, Eddie Bauer, Rosen Hotels, and the Home Depot have something in common, and it’s not just that their POS systems were hacked. All of them are examples of the high cost of reactive cyber security, which focuses on cleaning up after breaches happen instead of preventing them in the first place. This is the crux of the data breach lawsuits the banks are filing; they are alleging that hackers shouldn’t have been able to access these companies’ POS systems in the first place. They’re right. Hackers would not have been able to get in had the affected companies invested in proactive cyber security and implemented sound governance, risk, and compliance procedures.

The problem is not exclusive to large national or multinational corporations; it is estimated that 86% of small and medium-sized businesses woefully underfund their cyber security measures, and three-quarters have, at most, two staff members devoted to security (some have none). Yet as badly as companies the size of the Home Depot are being hammered by data breach lawsuits and other cleanup costs, they can afford to take the hit and keep going. A small business with razor-thin profit margins, or a young startup that’s not yet in the black, could be bankrupted by a data breach, especially if lawsuits are involved.

Often, it’s not that small businesses don’t care about being secure; it’s that they think they couldn’t possibly afford it. The good news is that proactive cyber security does not have to cost a small fortune. RegTech software solutions such as Continuum GRC’s IT Audit Machine (ITAM IT audit software) automate GRC and security processes and put world-class security, compliance, and risk management within the reach of small and medium-sized businesses.

Don’t be reactive and wait for a breach to happen and potentially bankrupt your business; be proactive and prevent hackers from getting in to begin with.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance with all applicable laws, frameworks, and standards.

[bpscheduler_booking_form]

“ClearEnergy” May Have Been Fake News, But Threats Against ICS / SCADA Security Are Quite Real

Accusations of “fake news” rocked the cyber security industry last week after infosec provider CRITIFENCE implied that it had detected a brand-new “in the wild” ransomware variant called ClearEnergy that posed a clear and present danger to ICS and SCADA security — and it turned out that ClearEnergy didn’t actually exist. Bleeping Computer reports:

After the publication of an article in Security Affairs called “ClearEnergy ransomware aim to destroy process automation logics in critical infrastructure, SCADA and industrial control systems,” security researchers used Twitter to bash the company for what they felt were lies about real world attacks, the company orchestrating a media stunt, and not releasing any research they could vet.

After being mercilessly taken to task on Twitter, CRITIFENCE engaged in furious backpedaling, claiming that the company had “[forgotten] to mention [that ClearEnergy] was only a proof-of-concept ransomware, and promised to release more details in the upcoming days.”

However, it turned out that this particular fake news story contained a rather important kernel of truth; Bleeping Computer reports that “two security flaws CRITIFENCE discovered are real and have resulted in a patch from Schneider Electric, the PLC vendor whose products are affected.”

The ClearEnergy debacle does not negate the fact that ransomware and other cyber attacks against the government and critical infrastructure are skyrocketing, and ICS and SCADA security is in bad shape, putting our nation’s critical infrastructure at risk.

Government Organizations Besieged by Ransomware

Ransomware attacks are most commonly associated with the healthcare industry, but in reality, educational institutions are the most frequent ransomware targets, followed by the government, with healthcare in third place. Attacks against government facilities are growing rapidly, having tripled over the past 12 months.

There’s no reason to think that hackers cannot or will not target the SCADA networks and other industrial control systems used by utility and transportation organizations, other critical infrastructure providers, and even automation systems for “smart” buildings.

In fact, it’s already happened. Last Friday, hackers breached the emergency warning system in Dallas, Texas, causing 156 warning sirens to begin blaring in the middle of the night and panicking residents, who flooded the city’s 911 centers with calls. Other notable attacks against critical infrastructure include:

• The Stuxnet virus, believed to have been developed and unleashed by U.S. and Israeli spies, disabled the Natanz nuclear facility in Iran.
• A Ukraine power company’s SCADA network was attacked shortly before Christmas in 2015, knocking 30 substations offline and plunging 230,000 residents, as well as the utility company itself, into the dark.
• A U.S. federal indictment handed down in 2016 accused a team of hackers with ties to the Iranian government of repeatedly breaching the SCADA system at a dam in New York State.
• In 2008, a teenager hacked the SCADA system at a train station in Lodz, Poland, derailing four trains. The teen told the authorities he had launched the attack because he was “bored.”

SCADA Security Can No Longer Hinge on Obscurity and Isolation

ICS and SCADA networks were first introduced in the 1960s, and some organizations are still running legacy systems that date that far back. They suffer from the same problem as ATMs and electronic voting machines: Because their design pre-dates the internet, they were built with functionality, safety, and efficiency in mind, but not cyber security. When threats of cyber crime emerged, it was assumed that SCADA systems were inherently safe because of “security through obscurity” and “security through isolation.” Some SCADA equipment is not continuously connected to the internet (isolation), and most systems use proprietary interfaces and specialized protocols that aren’t widely known (obscurity).

The problem with equating obscurity and isolation with cyber security is that the internet has rendered both of these “protective” measures obsolete. While industrial control systems and protocols may be obscure, they are far from impossible to research; after all, a bored teenager managed to figure it out. A determined cyber terrorist can also enlist the help of a malicious insider or use spear phishing or another social engineering scheme to take advantage of an unwitting employee. Isolation cannot be counted on because all SCADA equipment must periodically be connected to the internet, or at least to a flash drive, for brief periods to send and receive information or download updates.

Eventually, a terrorist will hack a SCADA system at a power plant, a train station, or another part of the nation’s critical infrastructure, possibly as part of a larger terrorist attack. Public and private sector agencies must work together to proactively secure industrial control systems and ensure they meet the highest levels of cyber security.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call +1 (888) 896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance with all applicable laws, frameworks, and standards.

Schedule some time with our Superheroes for a Free Assessment!

[bpscheduler_booking_form]

Don’t depend on a cyber insurance policy to cover your losses after a ransomware attack.

Hackers have discovered that there’s fast, easy money in holding enterprise systems hostage, especially in industries that process and store highly sensitive data, such as education and healthcare. The U.S. Department of Justice recently reported that ransomware attacks quadrupled between 2015 and 2016, to an astounding 4,000 attacks a day. Most businesses hit with ransomware are knocked offline for at least a week, and it’s estimated that the ransomware epidemic cost organizations over $1 billion last year alone. With those sobering statistics in mind, more organizations are considering purchasing cyber insurance to protect themselves. But while cyber insurance can help to some extent, it is no substitute for comprehensive information security.

Cyber Insurance Coverage Can Be Expensive, Skimpy, and Uncertain

Cyber insurance is a brave, uncertain new world for both insurers and policyholders. Because widespread internet access is relatively new in the grand scheme of things, and the threat landscape changes daily, insurers don’t have access to the historical data they need to build accurate predictive models, nor do they have the technical expertise to anticipate future threats. Meanwhile, a lack of standardization means that organizations cannot make “apples to apples” comparisons when evaluating coverage options – if the organization even knows how much coverage it needs in the first place, a tall order in a world where businesses are only now coming to terms with cyber threats and their individual risk environments. The result is a confusing marketplace filled with high cost, “skinny” policies. It’s understandable why fewer than one-third of U.S. businesses have purchased coverage, including only 40% of Fortune 500 companies.

All Insurance Policies Have Exclusions

Like all other types of insurance, there are certain things cyber insurance won’t cover. For example, cyber insurance does not cover ransomware attacks that are connected to malicious insiders, such as a disgruntled former or current employee, or even an angry vendor. Additionally, if a policy does not specifically include “extortion coverage,” ransomware won’t be covered at all. Even worse, if a business publicly discloses that it has purchased extortion coverage – such as in a press release or in an SOC report – the policy is rendered invalid.

The legalities of cyber insurance are evolving as quickly as the threat environment; what is and isn’t covered can be difficult to determine, and policyholders may find themselves having to take their insurers to court to get their claims paid.

How Long Can You Afford to Be Locked Out of Your Systems?

Remember that insurance does not prevent catastrophes; it helps you clean up after a catastrophe has occurred. Even the most robust cyber insurance policy cannot protect against the biggest problem ransomware causes: Being locked out of your systems and data for days, weeks, perhaps even months. In a healthcare environment, the inability of front-line employees to access electronic medical records could result in patients being maimed or even dying. While organizations in other industries may not face literal life-and-death situations, the damage from having to cease operations until the computers are back online could be crippling, especially for startups and other small businesses.

The Best Defense is a Good Offense

If you are thinking of purchasing a cyber insurance policy, don’t attempt to go it alone. Seek professional help from a reputable cyber security firm such as Continuum GRC. Our experts will evaluate your risk environment, determine how much coverage you need, and help you choose the most suitable policy for your organization’s needs.

However, cyber insurance coverage is not a replacement for comprehensive, proactive cyber security. The best way to defend your organization against a ransomware attack is to make sure one never happens in the first place.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance with all applicable laws, frameworks, and standards.

[bpscheduler_booking_form]