What is the real risk if my company doesn’t have Network Security in place?
Network Security Breaches on the Rise
It seems that you can’t see a news story without reading about some kind of data breach or other failures in network security. In fact, according to the Identity Theft Resource Center, 2015 saw the second highest number of data breaches since they started keeping records. Business and Health and Medical combined were victim to over 75% of the breaches.
Most recently, Hollywood Presbyterian Medical Center in Los Angeles was hacked and the electronic medical records were held hostage for 40 bitcoins, approximately $17,000. Adam Kujawa from Malware Bytes was quoted in the Time as saying “Unfortunately, a lot of companies don’t tell anybody if they had fallen victim to ransomware and especially if they have paid the criminals,”… “I know from the experiences I hear about from various industry professionals that it’s a pretty common practice to just hand over the cash.”
The Cost of an Internet Security Breach
In the case of Presbyterian Medical, the cost of their failed internet security is fairly easy to quantify, 40 bitcoins or $17,000, not counting the soft costs of the time and loss of productivity. Presbyterian Medial reverted to hand written records while the issue was being resolved. That meant fewer patients seen and less revenue generated. Although only the hospital knows the actual costs good money says it is significantly more than $17,000 and the potential cost was much higher.
Some reports indicated the hospital could not access digital diagnostic equipment. It is unclear if any lives were at immediate risk but it isn’t difficult to come up with a scenario where a life may be lost or a patient’s quality of life may be seriously impacted. In either case, although the moral responsibility would be with the hacker or hackers, legal and financial responsibility may vest in the hospital. Especially if it is proven that the breach of their web security was the result of gross negligence on the part of the hospital.
There are also addition costs to consider besides potential loss of life and the monetary loss associated with the extortion. By not having proper internet security in place the hospital may be subject to regulatory fines. HIPAA breaches can be costly. In 2014 NY Presbyterian Hospital in a joint venture with Columbia University were fined $4,800,000 after a breach.
Exposure is not limited to either the medical field or large businesses. According to Kaspersky Lab Survey of 5,500 businesses worldwide over 90% experienced some kind of data breach with 46% of them losing sensitive information. The cost for enterprise businesses was $551,000 in direct cost and an additional $69,000 in indirect costs. Small businesses didn’t fare any better relative to their size. Direct costs for small businesses per breach was $38,000 with another $8,000 in indirect costs. Proportionately the small business is impacted significantly more than the enterprise.
Breakdown of potential cost for poor information security
Hard Cost
- Ransome Cost (in the case of ransomeware) – the price you pay to the perpetrators to release your network
- Remediation Cost – the cost you pay a security professional to restore your network
- Regulatory Cost – fines by governmental bodies for failure to protect sensitive data (HIPAA, Sarbanes-Oxley, etc)
- Legal Costs – settlements and attorney’s fees in the case of civil action
Soft Cost
- Loss of Productivity
- Loss of customer goodwill
- Loss of customers
Clearly businesses are at risk and internet security should be top of mind for all business owners but is that sufficient? Network security is much more comprehensive then protecting against network hacks. A comprehensive network security plan needs to include internet security, information security as well as physical security. In the coming weeks we will discuss the how to determine which security measure you need and which ones are optional for your business and then how to choose the right solution for your company.
The post What is the real risk if my company doesn’t have Network Security in place? appeared first on SDTEK | San Diego, CA.
