What Moody’s and Standard & Poor’s are to credit ratings of companies, companies such as  FICO and Bitsight are becoming to cyber risk ratings for companies. Businesses have relied on credit ratings to determine investment risk levels and now companies are relying on rating companies to have a standard bench mark of cyber risk.  This growth industry of raters includes a number of providers and their customers use their services in a variety of ways.

Uses of Cybersecurity Scores

Insurance companies often use cybersecurity scores to help assign risk level for cyber insurance. Potential impact: Cost for cyber insurance will likely be higher for small businesses with gaps in their cybersecurity than for companies that have strong measures in place.

Businesses use scores to rate their third party providers during selection process. Potential impact: Suppliers may lose bids not on cost or service commitments, but rather on weak cybersecurity.

Businesses use scores to monitor their third party providers’ security risk level and potential impact to them. Potential impact: Large businesses may demand stronger cybersecurity measures from its suppliers and terminate agreements with low scored providers.

Businesses use scores to monitor their competitors’ cybersecurity level. Potential impact: Businesses may find ways to leverage a competitive advantage of their strong cybersecurity v their competitors’ weaker measures.

Companies use their own score to communicate their risk level to the board of directors. Potential impact: This may provide support for cybersecurity management to get the support they need due to increased board awareness.

The Data

Data comprising the cybersecurity score is gathered from a variety of publicly accessible information sources, including:

• Hackers’ forums and data available on the Dark Web
• Use of multi-factor authentication by a company
• Known vulnerabilities to a company’s network
• Open ports to a company’s network
• Patching practices

The risk raters also analyzing data that may flow into or out of a network to determine volume of malware, spam, or viruses that may be associated with a company’s network. The raters couple the data collected and analyzed with their proprietary predictive modeling. In some services, the data is monitoring continuously and a rating may quickly change to reflect any fluctuations. For example, if stolen data suddenly appears for sale on the Dark Web, the rating of the impacted company may be quickly decreased.

What You Can Do

If your business uses third party providers, you should think about investigating the services of scoring companies. If you are a supplier to a large company, you should consider talking to your client about how they are using cybersecurity scores for their vendors such as you. Cybersecurity is no longer a private matter within your own company. Future business deals and contracts may be won or lost on cyber security effectiveness, not just price or service levels.

The automotive industry’s cyber threat information sharing organization, Auto-ISAC, recently announced its best practices for cybersecurity measures for automobiles. The best practices are intended for all manufacturers and suppliers in the automotive industry, regardless of size. The organization states they built in flexibility for implementation by a range of companies.

Auto-ISAC is a member of the National Council of Information Sharing and Analysis Centers (ISACs). ISACs were created for various critical infrastructure industries after a presidential directive in 1998. The directive asked key critical infrastructure sectors to establish organizations that would share information about threats and vulnerabilities within their specific industry. Auto-ISAC is owned and operated by automotive manufacturers and suppliers.

The Auto-ISAC’s best practices are categorized by functions:

• Governance
• Risk assessment and management
• Security by design
• Threat detection and protection
• Incident response
• Awareness and training
• Collaboration and engagement with appropriate third parties

One lesson learned from the risk assessment and management category is the acknowledgement that cybersecurity needs to be part of the supply chain. The best practices recommend including the supply chain in risk assessments as well as developing a process to confirm compliance by critical suppliers to verify security requirements, guidelines, and training. A manufacturer can’t ensure final security without including all key suppliers.

Another lesson that can be learned from the automotive industry is its recognition that cybersecurity in the industry is about safety, not a competitive advantage. The best practices call out specifically the need for sharing of information with third parties such as Auto-ISAC, peers, researchers and government agencies. Collaboration is important among stakeholders to defend against cyber-attacks.

Billington Cybersecurity, a media company that produces a variety of events on cybersecurity, hosted a conference last week for the automotive industry. The Cyber Wire covered the conference in detail and noted that the large manufacturers are taking collaboration and sharing seriously.

The conference was attended by the Department of Transportation, auto manufacturers and suppliers. Participants seem to be highly interested in how other critical industries such as aerospace and defense are handling cybersecurity. A further lesson learned for small businesses is that increasingly, industries realize cyber-attacks need to be discussed among industry players and best practices shared.

Small businesses have an opportunity in many of their industries to be part of cybersecurity conversations and industry cybersecurity initiatives. Small businesses have as much to lose in cyber-attacks as do large businesses. Small business voices should be expressed to ensure their needs are represented.

In congruity with the Department of Homeland Security’s nationwide initiative to promote a unified cybersecurity effort, the National Cybersecurity Institute is hosting daily podcasts that discuss information security topics. For Week 2 of National Cybersecurity Awareness Month, NCI would like to focus on the podcast entitled “Encryption.” This topic is one of the most important when it comes to combating cyberthreats and being prepared against modern cyberattacks.

What is encryption?

To keep things simple, James Antonakos of the National Cybersecurity Institute explains encryption as the process of taking data that is readable and making it unreadable to humans. Encryption is made possible by using algorithms to create complex codes out of simple data, effectively making it more difficult for cyberthieves to gain access to the information. According to Florida Tech University, encryption is the most widely used form of data security because its ciphertext and coding make it more difficult to crack than basic password protected information. To really understand encryption, however, one must take a closer look at the various types.

Symmetric vs. Asymmetric

Symmetric

This type of encryption is also frequently called “secret key encryption.” Computers use the same algorithm, or key sequence, to decode the encryption as they would have to initially encrypt the information. This is an advantage in terms of key management because there is only one code to memorize. However, because there is only one line of defense, businesses must be careful in choosing who gets access to the key.

Asymmetric

Sometimes called “public key encryption,” this method means that the cyberdefense has been built with more than one key. Typically, it is one key to encrypt the information and a separate one to decrypt the data. While managers using asymmetric encryption do not have to spend as much time worrying about key distribution, or the number of people who have access to the keys, they must pay close attention to key management. Having multiple keys can create confusion, so it is important to keep the codes organized.

Why is it important?

While cybersecurity managers may dislike encryption because it requires constant maintenance, it is often your last line of defense from cyberattack, according to Tech Republic. Even if hackers break through firewalls, passwords and anti-spyware software, encryption is still in place to keep them from viewing the protected data. Because encryption algorithms are often difficult to break, this method of cybersecurity is often the most effective.

To learn more about encryption and other topics related to cybersecurity, visit the National Cybersecurity Institute’s website today.You can also find out about degree programs such as Excelsior College’s Online Bachelor of Science in Cybersecurity and Online Master of Science in Cybersecurity ..

Look…up in the sky…it’s a bird…it’s a plane….it’s…connectivity!

If you are like most people you have had the experience of losing your Internet connection when traveling to areas where there is a ‘dead zone’. It is frustrating to be sure. Imagine how frustrating it would be if you were living in entire areas of the world that were without coverage.

Enter Facebook and Google to the rescue in an effort to eliminate areas of non connectivity. Facebook just completed its initial testing of its massive (747 size) solar powered done that will, if things work out, beam Internet service all over the planet. Writing for CNN Money, Heather Kelly writes “The drones will be solar powered and use lasers to deliver internet connections receivers on the ground, up to 30 miles in any direction. The connections will be fast, with speeds up to tens of thousands of gigabytes per second”. Facebook envisions a huge fleet of such drones flying at extremely high altitudes beaming connectivity to everyone….and for free!

Google has also put forth similar ideas with a fleet of high altitude balloons with the same mission. According to google.com….”Many of us think of the Internet as a global community. But two-thirds of the world’s population does not yet have Internet access. Project Loon is a network of balloons traveling on the edge of space, designed to connect people in rural and remote areas, help fill coverage gaps, and bring people back online after disasters”.

The idea of free Internet with no dead zones around the planet is something we can all enjoy, here in the US or in the many undeveloped sectors of the world.

Sources

Kelly, H. (2016) Facebook’s giant internet drone nails test flight. Retrieved from the Internet at http://money.cnn.com/2016/07/21/technology/facebook-aquila-drone-successful-flight/index.html?iid=ob_homepage_tech_pool

http://www.google.com/loon/