The Evolving Face of Cybersecurity

Without an incident response plan, it can take a business an average of 71 days to recover. A business with a plan might recover in 20 days. That’s a difference of 51 days during which business is compromised, if not suspended. “What’s your loss of revenue?” asked Connery.

And, a cyber incident doesn’t end with the demand for money from the attackers, or with the lost revenue while the business struggles to perform during and after the attack. There are also regulatory fees, new Securities and Exchange Commission (SEC) reporting regulations, Federal Trade Commission (FTC) standards, notification of government entities and notification of customers whose information was compromised.

For businesses without a plan, recovery will take time. Backups may have been destroyed. Systems need to be rebuilt. “If that happens inside your organization, you must have options,” said Connery. “You have to think through what the next steps are going to be.”

One option is to pay the hackers to get data back. Another is to use an old copy of data that might be six months out of date. And the whole time the business is losing customer faith, losing time, losing revenue.

When it comes to cyberattacks, it isn’t if a business is at risk. It is. It isn’t if there’s an attack. It’s when.

Common Threats and Vulnerabilities

“Cyberattacks can take various forms,” explained Mark Doering, chief information security officer, Link Technologies. “There’s phishing and malware and denial of service attacks, which is preventing access to systems, social engineering which is the phone calls and texts you get soliciting a response and pretending to be someone else.”

There are also structured query language (SQL) injections, which attack data applications by injecting malicious SQL statements into entry fields for execution, affecting execution of predefined SQL commands and allowing attackers to spoof identity and tamper with data; zero-day attacks that exploit previously unknown vulnerabilities in systems; and nation-state cyberattacks from foreign entities.

“From my perspective, [Nevada sees] pretty much the same sorts of phishing attacks, ransomware,…