Data breaches have the potential to cause immense disruption, not to mention an immediate negative impact on reputation. That’s why when a big corporation suffers a cyber attack, it is well publicised, and customers begin to vote with their wallet and look elsewhere. It’s been estimated that 83 per cent of consumers change their spending habits after a data breach; hardly surprising when it is often our own personal data that is at stake.
There has been a long roll call of major security breaches and we can see how they have negatively affected the companies in question. Whether it’s allowing access to customer records or even credit card details in some cases, there are plenty of examples of cyber attacks causing major reputational damage and resulting in hefty fines.
This is a battle that sometimes seems unwinnable: in 2023, there were over eight billion reported breached records according to research. With such relentless uncertainty and distrust, how can we encourage a more understanding and transparent relationship between consumers and companies? Clearly, no one is immune, therefore when selecting a vendor or a partner, how they react to security incidents when they inevitably happen is key. It is tempting to punish organizations that fall foul of cyber attacks, however, this only serves to make them more likely to cover up any breaches that might occur.
Stop the cyber shaming
It is easy to point the finger at individual employees who might have clicked on a phishing link or replied to a spoof email, but a more understanding approach would be more useful. At the end of the day, malicious phishing attempts and other crude cyber attacks are a pure numbers game: by casting their net as far as possible, sooner or later someone will take the bait. And these crude attacks are becoming more nuanced, helped lately by the advent of generative AI, making human error more likely. That means we must make a fair assessment and not blame the victim. Otherwise, victims are more likely to conceal any incidents for fear of punishment, leading to potentially more harm in the long term. In an environment of transparency and compassion, that same victim will be much more likely to self-report attacks, accept they are at fault, and learn from the experience. That’s critical because, as IBM reported last year, the sooner you detect a breach, the less damage is done.
Instilling trust
Whether we can successfully embed a culture of trust and transparency internally, it doesn’t always extend beyond the realms of the organization to partners, vendors and third parties. Anyone can be struck by a security breach so cutting off a usually trustworthy partner because they have been attacked might be considered hasty and could cost in the long term.
To assess how prepared your partners are for data breaches, introduce compliance frameworks and security benchmarks. Third-party risk management (TPRM) helps bring your third-party risk under control to improve security and compliance by identifying and mitigating risks created when working with outside organizations. It is a proactive solution to risk control, which provides the framework, policies and procedures you need to evaluate new and existing third-party partnerships.
To pinpoint the most significant risks stemming from third-party vendors, it’s advisable to develop a risk register. This document serves to catalogue and comprehend the various potential risks arising from your third-party partnerships. Risk registers prove invaluable for organizations, facilitating the identification, mitigation, and resolution of diverse risk types.
By introducing TPRM, you can gather more data on tactics, techniques and procedures (TTPs), enabling better protection against cyber attacks. Indeed, rather than blaming partners for being attacked, we should encourage them to be more transparent for better long term outcomes.
Looking to a secure tomorrow
Becoming more considerate to victims when it comes to malicious breaches does not mean that companies can ignore their core responsibilities. Rather, organizations must continually test the status of partners and vendors to ensure consistent compliance. Ongoing security reports and benchmarks are critical in ensuring that our partners are managing their data carefully.
Even the most judiciously managed company can fall prey to a malicious breach, so we must avoid shaming the victim and should instead offer the same understanding we extend to employees who have acted in good faith. Nobody, employee or partner, is perfect so embracing a culture of transparency and honesty will prove of long term benefit to everyone involved.
The author
Matt Hillary is CISO, Drata.
