The correct way of dealing with the RoI questions on cyber security

Cyberattacks are an integral and often unavoidable part of being digital businesses. Jayant Saran believes there is a way to think about return on cybersecurity investments.

Cyber forensics services that helps enterprises respond to cybercrime attacks have seen increased queries in the past couple of years. This indicated two things: that the number of attacks being faced and identified by our clients was increasing; and organizations appeared to understand that cyber-attacks are a reality that need to be addressed.

This could possibly signal a change in mindset around how organizations have traditionally perceived cyber security efforts. From a reluctance to report such attacks and incidents, clients are now more keen to remediate with external assistance, where required.

While more may need to be done to create and maintain a national repository of incidents, CERT-IN has seen an increase in reporting by organisations. What may help is perhaps masking the name of the affected organisations and limiting the details to the industry sector.

Another conversation we often have with clients tends to be about the return on investment (RoI) for their cyber security spends and whether this is ‘justified’. (To start with relatively large amounts of money tends to be invested towards cybercrime prevention. Should breaches occur, additional investments are necessary for remediation.)

While budgetary spends have increased, and are split over the tools and people (skills) required for prevention, organisations are under pressure due to the rising salaries for skilled professionals.

Increased demand and limited supply of skilled cyber security and cyber forensic professionals have resulted in higher salaries putting additional pressure on organisations.

A number of companies have chosen the outsourcing model where either the personnel, or the staff and in some cases both are outsourced to external parties.

So how then should one look at the RoI from cyber security initiatives? The response to this question is in two parts. First, it would not be wise to look at security spends from a ‘successful attack’ perspective. It would be more prudent to see how many attempts and attacks have been prevented by the cyber security initiatives undertaken by the organization.

While it may be difficult to estimate the damage that could have been caused by any of these ‘successful attacks’, it would at the very least be possible to assess the number and volume of incidents that the organization would have had to respond to in the absence of the right cybersecurity infrastructure.

The second part of the response to the RoI question is the opportunity to gather intelligence that can be derived from collating, aggregating, and correlating the different attempts identified by the cybersecurity infrastructure.

Of course, while performing such assessments organizations need to keep smokescreens and diversionary tactics of attackers in mind.

We have, in our cyber forensics practice, however seen clients fall prey to ‘forced’ attempts to correlate. For example, in many cases we have seen clients eager to correlate events occurring around the same time.

While this could help in the analysis, there are times when they can negatively impact investigations or root case analysis. Especially in case of spam attacks, we see no correlation to start with but in case it becomes a successful phishing attack, there is a rush to connect every spam email to the phishing attack.

Organizations need to remember that cyberattacks are not one-to-one. It is often one attacker attempting to breach several organizations in parallel and similarly each organization may be the target for several cyber attackers at the same time.

Efficacy of cybersecurity initiatives

It is important to focus on three key points over and above creating a technology-driven cybersecurity or cyber defense capability. These are not very different from what one would seek from an overall fraud risk management perspective.

First, people tend to be the weakest link in cyber security initiatives. In almost every cyberattack there is a human action that enables the attack to become successful — whether it is clicking on a phishing link, visiting a malicious site that infects a machine, or opening an attachment that could result in ransomware or other malware entering an organization’s technology environment.

It is imperative that adequate effort is made to regularly train employees and other third parties who access the organization’s network about existing and emerging threats.

Second, in addition to relying on technology driven controls, there is need for additional steps that can help prevent an attack from being successful. For example, a common occurrence is a business email compromise that often results in an email being received by members of the finance team from a supplier or vendor instructing change in bank account details followed by payment instructions to the new account.

We have noted in some instances that the person in finance team replies seeking more information to the spoofed email, which naturally goes back to the fraudster or external attacker. If the control is modified that any such change needs to be verified on the phone with a fresh email being sent to the vendor, some instances of such fraud can be prevented.

Of course, how the compromise happened might still need to be investigated but at least the organization does not lose money due to funds transferred to an account controlled by a fraudster.

Third, it is important that the organization has an incident response plan to respond to a cyber-incident. This is similar to the organization implementing a fraud response plan that defines roles, responsibilities, and the process for responding to an incident. This can equip organizations with a speedy response to incidents or attacks.

A typical cyber incident response plan comprises/contains documented ownership of actions based on the nature of incidents, involvement of other departments such as the legal team, human resources and media relations, besides instructions to contain the damage.

This also includes arrangements with external teams to come and assist with remediation efforts should the need arise. We expect to see a large number of organizations developing cyber incident response plans, given the high preference to opt for cyber liability insurance plans.

Lastly, an issue often noted when organizations initiate incident investigations is that the IT operations team may not be fully aligned with the cyber security operations team.

The former tends to focus on business operations and when an incident occurs, the organization finds that information necessary for investigation purposes is often not available, rendering any remediation next to impossible.

Alongside conducting a readiness assessment addressing the availability of information in case of an incident, it would be prudent if organizations created a channel for transfer of data ownership between multiple teams.

Cyber incidents will continue to affect our lives as we spend more time on the web, both as organizations and as individuals.

Investments made towards prevention should no doubt be monitored closely. However, a significant portion of efforts should also go towards awareness creation and preparedness to respond.

About the author: Jayant Saran is Partner, Deloitte Touche Tohmatsu India LLP.


Follow and connect with us on , Facebook