The WannaCry and NotPetya ransomware epidemics demonstrated how quickly malware can spread across the globe and cripple businesses. Their impact extended beyond traditional IT infrastructure into operational systems used to control industrial, manufacturing, and critical infrastructures. The scale of these incidents is forcing organizations to consider the financial impact and business exposure associated with cyber threats, to better mitigate risk.
As in most cases, these attacks were made possible by poor operational security procedures (or lack of them), because the vulnerabilities they exploited, and the patches that protected against them, had been disclosed months earlier.
What’s lacking in many organizations is smart prioritization of vulnerability remediation efforts. One efficient way to accomplish this is by determining financial impacts posed by specific vulnerabilities that exist in the IT infrastructure.
Records-Based Exposure Models Are Inaccurate
Traditionally, financial impacts are estimated based on the number of personally identifiable information records that could be breached or exfiltrated during a cyber attack. This data is fed into business impact analysis systems or risk frameworks like FAIR to extract business exposure.
The WannaCry and Petya ransomware outbreaks encrypted but did not exfiltrate data. Therefore, when calculating the financial impact of cyber threats, you must consider the following factors: (a) revenue loss resulting from downtime, (b) staff time required for post-incident analysis, (c) infrastructure damage and the cost to implement compensation controls, and (d) post-attack notification and legal costs.Threat-Centric Models Are More Reliable
To do this, organizations should assess their business exposure to individual cyber threats. This can be achieved through adversary modeling, using tactic, technique, and attack pattern frameworks.Predicting Financial Losses
Next, based on the organization’s business dependency on those files, we can use their unavailability as a factor to determine the financial loss that would result if they were compromised by a ransomware attack. Traditionally, cybersecurity risk is calculated using this formula: likelihood X impact = risk
The following modified version of this formula can be used to derive the financial effects based on a risk assessment:
likelihood X criticality X f (impact analysis) = financial impact
It can be applied against each vulnerability discovered during a risk assessment to estimate their individual financial impacts, which may be different.
By assessing the financial effects of individual cyber threats, organizations can more effectively prioritize remediation efforts, align security resources to protect their most critical assets, and allocate new investments to initiatives that will limit the business impact of attacks.