Auditing for Cybersecurity Risk

Equifax.

Equifax suffered a major breach in March 2017, but the company did not discover it until July 2017. It neglected to report the breach to the public and did so only after an SEC insider trading investigation into several executives uncovered that the executives knew about the breach. It was finally reported to the public in September 2017, yet Equifax was ill prepared to determine the actual number of breached individuals and failed to provide accurate information to the third-party remediation firm. The U.S. Senate report on the breach (http://bit.ly/2JAhceA) castigated Equifax for—

• not following its own patch policy (8,500 known vulnerabilities, including 1,000 critical vulnerabilities, were identified by a 2015 audit. Equifax failed to do any follow-up audits or patch its systems. Equifax’s patching policy mandated the company’s IT department patch critical vulnerabilities within 48 hours.)
• deliberately choosing to save personally identifiable information (PII), including usernames and passwords, in unencrypted file shares accessible by Equifax employees, and not having basic tools in place to detect and identify changes to files.

On May 22, 2019, Moody’s downgraded Equifax’s rating to “negative,” saying, “Higher cybersecurity costs will continue to hurt the company’s profit and free cash flow for the forseeable future.” While this is the first downgrade as the direct result of a cyberattack, it will not be the last.

Starwood.

Starwood suffered a significant data breach of approximately 500 million customers’ information. Included in the theft were over 327 million records with PII and over 5 million unencrypted passport numbers. The breach dated back to 2014, but was not detected until September 2018. For more than 1,300 days, Starwood data integrity had been compromised and no one, including Marriot, which acquired Starwood in November 2015, knew about the breach. Of note, the FBI Electronic Crimes division estimates that for every 100 days between a breach and the discovery of the breach, the cost of the breach doubles. This suggests that the ultimate cost of the Starwood breach will be 8,192 times the “original” cost had it been discovered immediately. A comprehensive security assessment at any time over the 1,300-day period would have found the breach.

Citrix.

On April 29, 2019, Citrix sent a letter to the attorney general of California confirming that a breach had occurred on October 13, 2018, 196 days earlier. In the letter, Citrix confirmed that it was advised of the breach by the FBI on March 9, but waited seven additional weeks to inform the public (http://bit.ly/2Erqbus). It also advised the public to utilize monitoring services from Equifax.

In none of the cases above were technology and tools the root causes of the severity of the attack. All too frequently, the cause of a breach lies in the actions of human beings.

Lack of business focus.

When a cyber-crime event occurs, the information security (IS) team or information technology (IT) team immediately begins attacking the problem with all of its resources. Too often, however, these efforts remain siloed from the rest of the business. At the same time, business units are experiencing critical systems failures and “pinging” the IT and IS teams to find out what is happening, and executives are dealing with the public reaction to the incident and its potential market implications. This only adds to the chaos, exacerbating the cost of the breach and significantly increasing the likelihood that the business will fail.

Lack of third-party support.

The chief information/chief security officer of a large New York–based credit union once shared his nightmare experience with the author, describing the helpless panic he felt in negotiating a deal with a world-class response vendor for the first 72 hours after a major data breach. He talked about his lack of leverage in negotiating anything with the third party, all while his credit union was front-page news. It was the worst 72 hours of his career.

The reason for third-party support is to get an unbiased view of the problem. The biggest challenge an organization has during an incident is that too many staff members operate under assumptions because they know the business and take logical shortcuts. Assumptions almost never match up to the reality, however, exacerbating the impact of the incident. The third party does not know the business and therefore must follow the documentation and the defined processes.

Lack of audit involvement.

Auditing is a key component in risk assessment and prevention. Without an independent set of eyes looking at the processes, policies, and governance issues, how can an organization ever have a clear picture of the risk? How can auditors ever certify the overall business health of the client—a critical part of 10-Ks and annual reports—without that understanding?

If this were primarily a technology problem, the big financial service firms and technology firms would never be hit, but they are. If this were only a technology problem, cybercrime would not be growing as fast as it is. The human factor underpins so much of the risk that enables cyberattacks and allows them to succeed, and it does so on both sides. Both the breachers and the company insiders whose mistakes enable successful breaches are human. There is an affirmative obligation for everyone responsible for cybersecurity (i.e., everyone) to recognize that ignoring the problem does not solve anything.

Focus on the business.

Incident response is a vital requirement for corporate health. It is a function that should report to the CEO or the board and be treated as a primary fiduciary responsibility by the board and executive team. Cybersecurity should be viewed as a business issue, not a technology issue, and every part of the business should be on the same page. Auditors need to call this out.

Understand the risks.

Auditors should ask clients, “Where is your most critical data?” If management is not able to answer that question simply, that’s a problem. In addition, auditors should ask about the IRP, password controls, regulatory impacts, and cybersecurity framework assessments such as National Institute of Standards and Technology (NIST) SP 800-53 or NIST SP 800-171. Auditors should understand the entire governance framework in use and assist by bringing in the right third-party resources to do the work.

Audit to ensure adequate resourcing.

An incident response team, when properly constructed, serves the needs of the business. To do that, the team must have stakeholders and representatives from all parts of the business. In addition, there should never be a single point of failure in any aspect of incident response. The only way to get organizations to understand the impact of these risks is to provide training.

Update understanding of the cybersecurity risks.

Assess the risk of the client’s environment on a regular basis. Identify the risks and look closely at which risks are most critical. An easy decision is to get rid of passwords; as currently constructed, password controls are a failure. Bill Burr, a manager at the NIST who wrote the password primer in 2003 that recommended many of the rules now in use, concedes that he was wrong and that the current paradigm actually increases risk. Instead, some form of multifactor authentication should be mandatory, such as a gold-chip ID card (e.g., PIV, PIVI, or RapidGate) tied to a registered device, such as the user’s cellphone.

Patch security flaws in a timely fashion.

Yes, there is much regression testing that needs to be done, and one patch can sometimes break production applications. But consider that the NonPetya/WannaCry(pt) day-zero patch was released in March 2017, and companies waited between 3 and 18 months to patch for it, at a cost of over $10 billion worldwide. The more than $348 million lost at Reckitt-Benckiser alone is far greater than the cost of a short-term production failure.

Implement more active and effective monitoring.

Once an organization understands the risks, it can effectively deploy the tools to better monitor risk areas. Furthermore, best practices dictate that an organization should have a predefined plan for periodic security framework assessments. This means using the best third-party tools available to do a deep scan of the entire enterprise. Whether done annually, biannually, quarterly, or continuously, know the timeframes. With a cross-industry average of approximately 220 days between a breach and its discovery, make an informed decision on how long the company can afford to leave an incident undiscovered.