The Top 10 Cybersecurity Myths, Part 2

May 1, 2015

This month’s column takes over where we left off in April, bringing to a close our Top 10 list of widely held cybersecurity myths. This month’s list should prove no less provocative.

Click here to see myths 6 through 10

5. The FBI Raid Jacket Myth. A surprisingly large number of companies decide not to contact law enforcement after a computer intrusion because they fear losing control. Let’s forget for a moment whether the company already lost control to the hacker. The FBI Myth is born of the misconception that law enforcement will descend upon a victim company in raid jackets, box up the computers, investigate the company instead of the hacker, and generally tell the company what to do. Fortunately, the norm for working with law enforcement is far less intensive, far less invasive, and far more cooperative. Both the FBI and the Secret Service are highly professional, and approach computer intrusion victims as just that, victims. They also recognize that business operations must continue during an investigation, and they make considerable efforts to efficiently get what they need in order to pursue the hacker and quickly get out of your way while you remediate your own networks.

4. The Unattractive Target Myth. A substantial number of companies, especially small and medium-sized enterprises, do not believe they will suffer from a computer intrusion based on their view that they are not attractive targets. Unfortunately, this level of modesty is misplaced and naive. The National Small Business Association recently reported that half of the small businesses they surveyed knew they had fallen victim to a cyber attack, leaving only a large question mark as to whether the remaining organizations were fully secure or simply unaware. In a separate study that included more than 500 U.S. executives, security experts, and others from the public and private sectors, nearly eight in 10 respondents reported they had detected at least one cybersecurity event within the prior 12 months, with the average number of incidents detected being 135 per organization. The truth is that small, medium and large businesses are specifically targeted by criminals and spies, and they also fall prey to automated malware that continuously scans networks for vulnerable machines without knowing first who owns them. If you’re online, you’re good enough, you’re desirable, and doggone it, hackers like you.

3. The Insurance Coverage Myth. Over half of the companies surveyed in a recent UK government report believed they had insurance in place to cover a network breach, while only 10 percent actually were covered. Another sizable group of the executives that responded had no idea which cyber risks, among the many, could be insured and which could not. Either way, if your company has not recently analyzed and assessed its cyber insurance coverage, the odds are that your company either thinks it has coverage in place that it does not, or that it thinks that it cannot get coverage in place that it can. There are a lot of false assumptions being made when it comes to cyber coverage, and companies would do well to reassess their plans regularly and stay on top of changes in the cyber insurance market.

2. The First Line of Defense Myth. I cringe when I hear somebody state that their rank and file employees are their first line of cyber defense. With few exceptions, the general workforce is more properly viewed as an important, but last, line of defense. Among other reasons, the bad guys simply have gotten too good at compromising websites and spoofing emails for the average employee to know better. As a result, mature controls rely less on the everyday employee’s ability to secure the network, and rely more on explaining to the workforce the importance of not intentionally subverting existing controls, as well as learning from the workforce which controls are likely to be subverted in order to get the job done.

1. The IT Responsibility Myth. More common than the First Line of Defense Myth is the myth that cybersecurity is primarily an Information Technology issue that can be automated. A single person can’t “set and forget” cybersecurity. The IT Responsibility Myth is particularly dangerous because it underestimates security requirements and lets Boards of Directors and C-Suite Executives off the hook. Information and network security must be addressed within the larger framework of enterprise risk management. Anything less fails to place cybersecurity into its greater business context and makes success more difficult.

Steven Chabinsky is global chair of the Data, Privacy, and Cyber Security practice at White & Case LLP, an international law firm. He previously served as a member of the President’s Commission on Enhancing National Cybersecurity, the General Counsel and Chief Risk Officer of CrowdStrike, and Deputy Assistant Director of the FBI Cyber Division. He can be reached at chabinsky@whitecase.com.

Ransomware and the propulsion of the extortion economy has rapidly eclipsed into a national priority. Recently, we observed the catastrophic impact of a widescale ransomware attack impacting gas pipelines and raising national gas prices overnight.