Cyber Security for business

A report by Jalen Barlow

March 21, 2016

Introduction
In 2013 one NSA IT consultant named Edward Snowden shook the world when he
released a number of classified documents revealing the lengths the US government
organization known as the NSA had been taking in monitoring online activity in part to
respond to cybercrime. That same year nationwide retailer Target had a data breached
which compromised 40 million different credit cards costing the company many millions
of dollars. With stories like these in the headlines its easy to see why more and more
businesses are evaluating current cyber threats to their organizations.

Research methodology
To better understand and evaluate the current actions businesses should take in
response to growing cyber security threats I will take the following steps.

Step one: Research the history of cyber security threats to businesses

Step two: Research consequences of failing to properly address cyber security

threats
Step three: Find examples of potential responses to security threats

Results
Step One: History of cyber security threats
To begin looking at the history of cyber security we can start by examining one of
the earliest cyber security threats to ever be released. This piece of software, known as
The Morris Worm, was created by a Cornell graduate student named Robert T Morris.
The worm would spread between computers running the BSD Unix operating system
that were connected to the internet. The worm itself didnt seem to have any major
malicious intent but it did cause the systems that it attacked to over utilize the PCs
system resources.
This event is significant not only because it was one of the very first cyber
security threats to be publicized, but it was also one of the first examples we have of a
government response to cyber security threats. In response to this Morris was the first

individual to be tried and convicted under the Computer Fraud and Abuse Act of 1986.
I believe this is significant because it shows what our initial responses were to cyber
security threats when they were first developed which, similar to other crimes, was to
prosecute the individuals responsible for these issues. That is still the case in the
modern day but as the world has become more and more connected it has become
more and more challenging to combat these threats simply by the threat of prosecution.
This may have been enough to stop the initial threats that arose around the start
of the internet but as time has gone on and the world has become increasingly
connected the threats have also become far more widespread. Threats are not only
domestic but international, and when smaller organizations, without the same resources
a larger organization might have, are faced with an international threat there isnt
necessarily much they can do. The map below, found live at
https://www.fireeye.com/cyber-map/threat-map.html, shows detected cyber threats
happening every second originating from various regions.

"Cyber Threat Map | FireEye." FireEye. N.p., n.d. Web. 01 Apr. 2016.

Step Two: Consequences of properly addressing cyber security threats

It is estimated that 90% of all data breaches affect small businesses. What does this
mean for small businesses?
Well to start off on average small business adding up expenses in excess of $36,000 for
a single data breach. Why does a breach cost so much? First a forensic examination is
required by an outside entity. Once the breach is discovered it is required by most
states that any customers that were affected by the breach be notified and potentially be
provided with credit monitoring. The business could be fined if it is found during the
forensic examination that the organization is not in compliance with PCI standards.
Below you can see a breakdown of the potential costs of a single cyber breach.

"The Guide to Tightening Your Social Media Security." TNW Network All Stories RSS.
N.p., 11 Nov. 2014. Web. 21 Mar. 2016.
In addition to the direct costs caused by such a breach an organization also needs to
take into consideration the indirect costs of such a data breach. First of all, chances are
that you as an organization are going to be spending a large amount of time working
through the issues caused by the data breach, taking you away from more productive
tasks associated with the business. You may lose your privileges with payment card
companies, potentially causing you to lose business from potential customers. Perhaps
most of all is the damage to your business reputation. Studies showed that potentially

up to 1/3 of customers terminated their relationship with a business following the

notification of a data breach.
With this data in mind it is easy to see how a data breach can be extremely costly and
can even potentially bring an organization to its knees.

Step Three: How to respond to cyber security threats

The first step for any small business is going to be to make sure you have all of the
basics covered before evaluating whether or not you need to take further actions in
securing your data.
First thing you have to think about as a small business is making sure your employees
know your security policies and understand basic cyber security principles. The fact is
that the top cause of data breaches is negligence by internal staff. Something as simple
as setting strong passwords can be enough to prevent a major issue.
The next think businesses need to take into consideration is the security of the software
they are running on. New threats are found in existing software on a daily basis,
organizations need to make sure they keep their security software as well as their
underlying system software up to date. There is also the consideration of the security
software you will use. Organizations need to have anti-virus/anti-malware software
installed on any device accessing the internet with additional layers of security added
depending on the need. Also adding a hardware or at least a software firewall to protect
sensitive data is a necessary layer of security to add.
It is also important to make sure a backup is done of any vital data. Not only in case of
unintentional data loss caused by user or software malfunctions, but also due to the
increasingly prevalent threat of data loss. Since around 2013 a new type of infection
has been wreaking havoc on businesses all around the world, this new type of infection
known as ransomware, or also as cryptolocker which was the first and one of the most
destructive versions. Instead of stealing your data this new type of infection does its job
by simply putting your data into an unreadable format by encrypting it. Without the
decryption key for your data you will never be able to put any of your data back into a
usable format. If you opt to pay the ransom you may get a key that allows you to

decrypt your data, but if you had usable backup in place to restore from you can simply
overwrite the broken data with the old data from the backup.
As an organization you also have to determine if you have data thats more sensitive
than other organizations might have or if for some reason your organization might be
the focus of targeted attacks. The most common type of sensitive data that
organizations have to protect is payment data. Thousands and thousands of payment
card transactions are carried out every day and the PCI standard was implemented to
help organizations better protect this data. Another common type of sensitive data is
medical information. Part of the HIPAA standards determine what organizations that
have to protect medical records have to do to prevent data loss. You also have to
consider if your organizations have any political implications and if there are people out
there that may threaten your organization due to that.
Fortunately for the more sensitive organizations specialists exist that can put your
organization through what is known as a penetration test. This is where an external
organization tests your technology to see if they are able to break in and scans your
network for potential vulnerabilities. These tests can include not only technology but
attempts to trick your staff into seeing if they fall for an avoidable trap they might see
while regularly browsing the internet.
Below you can see an example of the process taken in a penetration test.

"Penetration Testing Services." Penetration Testing Services. N.p., n.d. Web. 01 Apr. 2016.

Discussion
In summary cyber security has come more and more to the forefront of all of our minds
in recent years and if the trend continues the threats will only increase as time
progresses. Cyber threats not only affect the technology we work with but if not
handled appropriately can disrupt the entire workflow or an organization. Businesses
are acting accordingly and increasingly reacting to the growing threats. Those that
react too late end up with a shattered reputation and piles of expenses. Luckily there
are people out there constantly working to combat these threats and with the right
strategy you can make sure you have a little less to worry about.
Conclusion and recommendation
My recommendation would be that every business owner consider the following and
determine whether they are doing everything they can to make sure they are protected
from cyber threats.

What are the threats your business faces? Is it simply a breach due to employee
negligence? Or do you for some reason have greater threats that require great

expertise?
Is the data you have sensitive? Is it important? If its sensitive what are you
doing to make sure that it does not get into the wrong hands? If its important

what are you doing to make sure that it isnt lost?

When is the last time your organizations cyber security has been evaluated by a
professional? Is it time for an evaluation to be made?

If these questions are taken into consideration and acted on the risks to organization
can be greatly mitigated although not entirely avoided.

Works cited

"Edward Snowden Biography." Bio.com. A&E Networks Television, n.d. Web. 21 Mar.
2016.
"The History of Cyber Attacks - a Timeline." NATO Review. N.p., n.d. Web. 21 Mar.
2016.
"What Is Pen Test (penetration Testing)? - Definition from WhatIs.com."
SearchSoftwareQuality. N.p., n.d. Web. 21 Mar. 2016.
"Federal Communications Commission." Cybersecurity for Small Business. N.p., n.d.
Web. 21 Mar. 2016.
"Negligent Employees Top Cause of Data Breaches - Malicious Attacks Most Costly Slide 8." Negligent Employees Top Cause of Data Breaches. N.p., n.d. Web. 21 Mar.
2016.
"Cryptolocker Q&A: Menace of the Year." Symantec Security Response. N.p., n.d. Web.
21 Mar. 2016.
"Penetration Testing Services." Penetration Testing Services. N.p., n.d. Web. 21 Mar.
2016.
"The Guide to Tightening Your Social Media Security." TNW Network All Stories RSS.
N.p., 11 Nov. 2014. Web. 21 Mar. 2016.
"Cyber Threat Map | FireEye." FireEye. N.p., n.d. Web. 21 Mar. 2016.