By Chris Coriale, VP of Technology, CyberSponse.
It has been said that perception is reality. In a world where cyber attacks and data breaches are daily news, an incorrect perception can create a terrible reality. Wasted time. Lost profits. Damaged brand.
Having a team is not enough
A dangerous perception is that having a security team is enough to fight cyber attacks. The mere presence of a CSIRT or SOC is not enough. Only 36 percent of 674 US and UK organisations surveyed for a recent study believed they even had a strong defence, even though many had security teams in place.
Larry Ponemon, chairman and founder of the Ponemon Institute, observed that increases in threat intelligence do not necessarily mean increased security. Intelligence data can be outdated within seconds. Data alone is not enough to protect a company from a breach. Threat intelligence makes a security team more proactive, but a solid IR plan is also vital. Detailed plans for a variety of scenarios let a company react quickly and accurately, gathering and analysing essential data and isolating compromised networks. Without a plan, an organisation easily becomes the next statistic.
The damage is wider than the data
Another dangerous perception is that the impact of a breach is limited to the actual data compromised, plus a few days of bad press. The reality is harsher. Today's business platforms are deeply integrated with customers, vendors and partners. A breach has significant impact on the compromised organisation and on the wider ecosystem. Even where partners and vendors remain unaffected, damage to projects and relationships that drive shareholder value can be irreparable.
Communicate or pay for the silence
Only 23 percent of respondents to the Ponemon Institute study had a clearly defined public relations and communications plan in place for cyber security incidents. The speed and accuracy of public disclosure can make or break a company's long-term reputation, both with partners and the public. Legal and contractual obligations need to be identified in advance, with a process to avoid costly omissions.
Cyber threats are real and your organisation may be vulnerable. Security operations teams can reduce the risk, but without comprehensive plans for the team and for the organisation, attacks can still mean disaster.
Originally published 6 May 2015. Migrated to the new IRC site in 2026.