Hi everyone.
I'm Chris.
And welcome back to my.
Course on Enterprise Security fundamentals in this lesson we are going to discuss the concept of cost
of breach.
Now let's briefly have an overview of this concept.
Still the cost of breach is always an estimate.
That's a fact.
Even after a breach occurs the actual cost of the breach may never be accurately determined.
On top of the disruption to the business processes it is difficult to assess the value of intangibles
such as let's say reputational damage.
The cost of rehabilitating the compromised systems.
The cost of investigating the breach itself and the cost of any fines or penalties that may need to
be paid to the relevant authority.
Now let's take a look at some of the factors that contribute to the cost of the breach.
These factors are but are not limited to breach investigation systems rehabilitation the reputational
damage destruction of assets and compliance costs.
Now let's get into each and one of them and briefly explain each factor so breach investigation after
an attacker has been successfully ejected from the organization's information systems.
An organization should perform a thorough investigation to determine as much as it can about the particulars
of the breach.
Performing this investigation will cause the organization as it takes personnel away from their day
to day work tasks.
It may also be necessary to bring in outside expertise so that the full extent of the compromise can
be certain which again will cost money and time the benefit of these costs will be that the organization
has a clear picture of how the breach occurred how long the intruder was present within the organization's
information systems and the steps that can be taken to ensure that attackers will not be successful
leveraging the same similar techniques in the future
systems rehabilitation was the attacker has been successfully ejected from the organization.
Information Systems.
It s them necessary to ensure that those systems are rehabilitated.
Not only is it necessary to remediated the vulnerabilities that allowed the attacker in the first place
to compromise the system.
It is also necessary to ensure that any modifications that the attacker may have made to that systems
are located and removed rehabilitating the system isn't just a matter of reverting to the last backup
as it may be that the attacker compromised the system some time ago so reverting to the last backup
won't remove the tools that the attacker placed on the system to retain persistence.
If those tools have been included in the system backups for some time in many cases the only way to
ensure that a system is rehabilitated is to deploy it again from the beginning and then address the
vulnerabilities that allow the attacker to gain access
reputational damage.
Sometimes the biggest cost of a successful breach is to reputation reputational damage doesn't just
occur when sensitive internal documents are leaked to the media.
For example consider an e-commerce site.
Let's say that suffers a breach where customer payment information is compromised.
Well customers of that site may be wary of using the site again in the future especially if they've
had to cancel an existing credit card as a result of the breach itself.
When customers lose faith in an organization's ability to protect their information they are less likely
to interact with that organization in the future.
Destruction of assets.
Some attackers planned malware that is designed to destroy the systems of the target organization.
Some malware works by reconfiguring hardware to work beyond its safe specification for example overclocking
processor until it overheats and fails other malware erases detail on target systems or renders them
inoperable.
In some cases the malware is deployed deliberately destroying sensitive systems either to inflict financial
damage or as a way of forcing the target.
The organization's information systems to become inoperative
compliance costs another lets a change in the cybersecurity landscape is in the recent years.
That is has been how regulation has encroached on the industry.
Depending on the type of breach that occurs and the type of industry the target organization is in there
may be fines that must be paid to specific authorities as well as investigations and reports that must
be generated.
All of which cost money and organizational resources.
In some cases an organization that suffers a breach may be subject to ongoing reporting requirements
for a PDA period of several years.
In some jurisdictions This can include paying for periodic external audits to ensure that the organization
has correctly implemented the necessary security controls to minimize the chance of a similar breach
occurring in the future.
Now I want to talk to you about another concept and that is proportional security.
The idea of proportional security is fairly straightforward.
Think of it this way.
Don't buy a twenty thousand dollar safe if you're only protecting one thousand dollar diamond ring.
Make sure that your security spend is proportional to the assets you are protecting.
Sue let's quickly have a look of some of this concept and talk about that.
So one of the things that can happen very quickly in any security industry that you can let your let's
say paranoia get the better of you and especially when you've got people coming in trying to sell you
products they will sell you like this does the selling is like buying insurance.
They will sell you perhaps a policy that you would never need in a million years.
So with proportional security understand the value of the assets you are protecting.
Also what you need to have is you need to have a threat model that is understand that you shouldn't
be spending a disproportionate amount on an unlikely threat.
Well spending little money on obvious things for example don't put in extra large extraordinary expensive
external firewall but forget to properly configure your file system permissions so that anybody who
is inside the organization is able to access any data that they want.
And let's look for example at the Manning hack or the Snowden affair.
We will see that we had privileged insiders who are able to get access to things that they weren't or
shouldn't have had access because of security.
So they basically shouldn't have access to those data because of the security posture was very much
focused on the external rather than the internal.
And you can be absolutely sure that these days security the security posture has been improved.
But those organizations who suffered those breaches the other thing that you need to realize is that
perfect is the enemy of good.
Often you'll see discussions within the information security community when someone's talking about
using a particular technique to protect an information system someone will instantly bring up oh well
you can get around that if you blah blah blah blah blah blah.
Well you need to understand that you're not going to be able to protect against everything but what
you can do is you can make it substantially harder for the average attacker to compromise your organization.
You are never going to build an impenetrable barrier.
But what you can do is you can make it so hard for the average attacker unless they're really really
really off to you is going to take their baton bolt and go home and look for another target to compromise.
So it's not that you need to have an impenetrable security.
It's just that being so difficult to attack that everybody goes and chooses an easier target because
the Internet and the world is full of much easier targets to hit.
What I want you to do next is go on and take the quiz at the end of this section and this is to test
yourself and see if you have a good understanding of the concepts we have discussed in this section
and I will see you in the next session.
The section sorry and the lesson where we'll be diving into red team versus Blue Team exercises I hope
this has been informative for you.
And thank you for watching.