>> Who causes cybersecurity incidents?
The first thing that we talked
about was negligent employees.
Who is a negligent employee?
Well, that's someone who doesn't really have
a good understanding of
>> how cybersecurity incidents work.
>> A good example here is this meme that
the basic user changed his password to incorrect.
Every time he types in
the wrong password, it
tells him his password is incorrect.
Kind of an extreme that there are people who don't have
a good understanding
>> of how cybersecurity incidents work.
>> Your business partners.
Maybe you're in partnership
with the business or you're using some type of
contractor and you've given them
access to your proprietary information
and they don't understand or
have the same security policies that you do.
They might put your information at risk.
Another example is going to be insider threats.
We already talked about Snowden, an extreme example.
But there may be others that
maybe you've terminated someone and they
have some computer knowledge and they
put that logic bomb in your system that's going to
delete all your data or keep you
from getting access to that data.
Those insider threats.
The next one is going to be criminals.
Here's an example of some ransomware.
They're going to want to make money maybe off of
your systems because you had some
user click on something or
go somewhere that they shouldn't have.
They're going to try and get three dollars,
500 out of you.
Or hospitals now have come
under attack from ransomware and they're
getting tens of thousands of dollars just to get access
back to their patient information.
You're going to have hacktivists, terrorists.
Hacktivists are going to try
and cause some type of damage to your system
>> because they have a political ideology that may
>> differ from yours or they want to prove a point.
Terrorists, obviously,
the cyber plane is now
becoming the next generation of warfare.
We're going to see a lot more cyber attacks happening
instead of these mass kinetic attacks and wars.
Just because cyber is something that is
important and connects all
of us throughout the world, we now bank on that.
We have a lot of our critical infrastructure
that depends on cyber.
We're going to see a lot more of that happen.
Then we're going to have competition
>> from your business.
>> People who are a competitor with you,
they may want to hack into
your systems to get your proprietary information
>> so they can one-up you and
>> go ahead and get something to market before you do.
Then nation states.
An example of what we had with
nation states is the Stuxnet virus.
Where we essentially had an attack against a ram that
interfered with some of their program of
more logic controllers and
set back some of their development.
These are just some examples of
who causes cybersecurity incidents.
There's obviously could be more,
but these are just some of
the basic examples of who does that.
Why is incident response necessary?
We've already touched on this a little bit,
but again, cyber is that next plane,
that next generation of warfare.
Here's just some examples of how
cyber threats are affecting
the United States and US businesses.
The Justice Department has declared that
China's espionage activities are
so wide in scale that they
constitute a national security emergency,
as China targets almost
>> every sector in the US business.
>> That's pretty significant.
If you're out there and you've got something
that is worthwhile,
something that can go to market,
China may be trying to launch an attack against
you so they can configure
out how to build that and make that better.
We'll talk about some of
the Chinese threats
>> a little bit later on in this course.
>> According to 60 Minutes,
the activity is actually costing US
companies hundreds of billions of dollars in losses and
more than two million jobs have been
lost through these cyber incidents occurring.
That's pretty significant.
If we can prevent these or
mitigate these after they've happened,
we can save billions of dollars and actually
put people or keep people in their jobs.
The Center for Strategic and International Studies,
CSIS, estimated the likely annual cost
of cybercrime and economic espionage to
the world economy at
more than $445 billion
or almost one percent of the global income.
Again, that's just a significant number in terms of
dollars of the magnitude of cybersecurity threats.
Then just in the United States,
CSIS estimated that the US lost
about $100 billion in GDP in the year 2013.
Just underscores the significance of cyber threats.
Here's a graphic explaining of how much
a cybersecurity incident can
actually cost an organization.
We have this known cost that we
realize that we're going to have to deal with when
one of these incidents occurs.
One of the infographics here
that Deloitte has on their website
shows the costs that are
mostly well-known when one of these incidents occurs.
You're going to have that technical investigation.
You're going to have to notify
your customers that there's been a breach.
You're going to have to do something
>> to get you back into
>> regulatory compliance depending on
what type of organization you hit.
More than likely you're going to have to
be engaged in litigation.
You're going to have to hire an attorney and
those guys bill usually in
three-minute increments. That's not cheap.
Then you're going to have to provide some type of
protection to your customers after that happens.
During the OPM hack,
we had essentially notification set out
to federal employees that one, they've been hacked.
But two, here's something that's a weight of a two.
Look at your credit and see if
someone's trying to open accounts in your name.
You're also going to have to go on some type
of public relations circuit
to ameliorate that bad publicity that you've had.
Then you're going to have to figure out a way
to improve your cybersecurity.
Those are the above
the surface and the
>> better-known costs of cybersecurity.
>> That being said, there's going to
be some beneath-the-surface costs.
This is estimated this is going to be where
95 percent of your financial impact is going to occur.
The top, obviously those are very expensive.
But these underneath the
surface attack some things that you may
not necessarily consider are very important as well.
Your insurance is going to go up.
If you've had one of these cybersecurity incidents
occur and you've got an insurance coverage for it,
more than likely, just like
when you have a car accident,
your insurance company is going to raise your rates.
When you take on some of
these cybersecurity incidents and try to mitigate them,
you're going to have an increased
cost to raise your debt.
Then you're going to have an impact
in operations or disruptions.
That's one of the drawbacks
to having cybersecurity incidents to banks.
Even going offline for 30 minutes for
a bank could cost them millions of dollars.
Then you may have a loss of
value in your contract revenue.
You're going to have a devaluation in your trade name.
The Target incident when they were hacked
and they lost customers' credit card data,
they took a hit to their business.
Depending on what type of business you have,
your trade name is going to be pretty valuable to you.
I was reading somewhere where
the actual trademark name of Coke is
actually worth more than
the products that the company sells.
You could have loss of intellectual property.
If you'd make one specific thing,
you'd do it and you do it well and you
do it better than anybody else.
If someone were to steal that, it's lost,
it's gone forever and you no longer
have essentially the market share that you had.
Then your customers could also
>> lose faith in your ability
>> to handle information and they
may want to take their business somewhere else.
Those are just some of the beneath-the-surface costs
which more than
likely are going to far
outweigh the above-the-surface cost.
What is the purpose of cyber incident response?
It's going to be essentially a collage of
things that you're going to have to do.
You're going to have to determine
first if an incident has actually occurred.
That could actually be done by having some type
of electronic notifications and IDS that says,
hey, something has occurred.
Or maybe you've gotten some type of
virus from your virus detection software.
After you've determined that a threat has occurred,
you're going to actually have to stop the threat to
keep that damage from occurring over and over again.
The next thing that you're
going to have to do is you're going to
determine how the threat actually occurred.
You can go to the next step and mitigate or minimize
the damage and prevent it from trying to happen again.
Then we're going to want
>> to have to counter that threat.
>> Then lastly, we're going to want to
prevent that threat from reoccurring or spreading.