HOW WELL DO YOU EVALUATE RISK?

By Chris Butler, Principal Consultant, Sungard Availability Services

Did you know the world’s most dangerous animal is not a shark, or a bear, but is in fact a mosquito?

What’s certain is that human perception of risk is notoriously flawed; often, the events that concern and outrage us the most are the least likely to happen.

From political and economic tremors to cyber threats, 2017 represents another minefield of risks for businesses. For organisations, forging a deepened understanding of both threats and risk factors is crucial for remaining robust, resilient, and most of all, ahead of the competition. Part of this involves separating the myths from reality. So, what then are the real risks to business today?

• Reputational damage – This need not necessarily be caused by a fatal accident and ecological disaster like the Deep-water Horizon oil spill after which BP’s reputation and ability to bid for new contracts plummeted following its mishandling of crisis communications. As KitchenAid found to its cost, an employee inadvertently sharing a tasteless joke on the company Twitter account instead of his/her personal handle also has the potential to do damage. (To its credit, the company responded with a swift, credible apology and explanation within eight minutes of the tweet appearing – an excellent example of good crisis communications).

• Communications failure–Our own invocation statistics confirm that, communications failures share equal first with hardware and power failures are the leading reason for customers invoking their recovery arrangements with us. This was the cause of just over afifth (21%) of all invocations in 2016.[1]

• Weak links in the supply chain – It may be an oldie, but our digital age makes it no less true than before; an organisation is only as strong as its weakest link and it is vulnerable to any shortcomings in its third party ecosystem – that is vendors, partners, contractors and suppliers – which can have serious consequences.[2]

• Compliance with new legislation – Looking specifically at the General Data Protection Regulation (GDPR), an organisation’s readiness to adapt to the new challenges of data privacy and reduced tolerance for data breaches represents both an opportunity and a threat. We expect data breaches to increase this year as hactivists or blackmailers expose data privacy failings, leading to GDPR non-compliance issues.

And, of course with Cyber Security – the theme of this year’s BCAW– there is the ongoing and growing threat posed by:

• Malware – Home Depot took six months to discover malware had been installed that allowed hackers to steal the data of 56m customers before the breach was identified. Making a bad situation worse, it transpired that the management’s attitude towards staff raising concerns over poor information security was “We sell hammers”.

• Cyberattacks – Hackers were able to gain entry to French media organisation TV5Monde and take down its social media, websites and emails. The reconnaissance took place over an estimated five months before the attack was launched and it was over two hours before the station regained some control. Overall, 12 TV channels were taken off-air for 18 hours.

Closer to home, Tesco suffered the largest cyberattack ever on a UK bank with some £2.5m stolen.[3] Quite apart from the reputational damage, Tesco faces a potential fine under the EU’s General Data Protection Regulations that could be as high as £2bn. The financial sector is four times more likely to suffer a cyberattack than other sectors and in 2016 there was a 40% increase in cybercriminal activity[4] targeting the financial services industry.

• Ransomware–This continues to increase with the FBI estimating it will become a $1bn industry this year.[5] However, its ‘success’ is largely due to the human factor. Social engineering and phishing are two of the criminal methods that hinge on poor personal behaviours or lack of awareness in the individual.

While many think the elderly are more vulnerable, they are by no means the only target. Younger people may be tech-savvy but they are also more inclined to be more trusting and unaware of the proliferation of threats and means of attack.With one in 20 Twitter accounts estimated to be a fake bot account, we should all be aware of the dangers posed by social media and sceptical of potentially fake sites offering too-good-to-be-true deals on the latest Raybans or tempting links on Facebook.

Despite increasing awareness of the cyberthreats, hazards and risks that abound, human frailties and impulses will continue to provide challenges to business leaders in 2017 and beyond.

[1]Sungard Availability Services Availability Trends Report 2016

[2]http://www.standard.co.uk/news/uk/nandos-diners-fury-as-restaurants-run-out-of-chicken-on-bank-holiday-a3432166.html

[3]https://www.theguardian.com/business/2016/nov/08/tesco-bank-cyber-thieves-25m 8.11.16

[4]https://cybernewsgroup.co.uk/merchants-and-financial-institutions-deal-with-escalating-cyber-attacks/

[5]http://money.cnn.com/2016/04/15/technology/ransomware-cyber-security/

By Chris Butler, Principal Consultant, Sungard Availability Services

Did you know the world’s most dangerous animal is not a shark, or a bear, but is in fact a mosquito?

What’s certain is that human perception of risk is notoriously flawed; often, the events that concern and outrage us the most are the least likely to happen.

From political and economic tremors to cyber threats, 2017 represents another minefield of risks for businesses. For organisations, forging a deepened understanding of both threats and risk factors is crucial for remaining robust, resilient, and most of all, ahead of the competition. Part of this involves separating the myths from reality. So, what then are the real risks to business today?

• Reputational damage – This need not necessarily be caused by a fatal accident and ecological disaster like the Deep-water Horizon oil spill after which BP’s reputation and ability to bid for new contracts plummeted following its mishandling of crisis communications. As KitchenAid found to its cost, an employee inadvertently sharing a tasteless joke on the company Twitter account instead of his/her personal handle also has the potential to do damage. (To its credit, the company responded with a swift, credible apology and explanation within eight minutes of the tweet appearing – an excellent example of good crisis communications).

• Communications failure–Our own invocation statistics confirm that, communications failures share equal first with hardware and power failures are the leading reason for customers invoking their recovery arrangements with us. This was the cause of just over afifth (21%) of all invocations in 2016.[1]

• Weak links in the supply chain – It may be an oldie, but our digital age makes it no less true than before; an organisation is only as strong as its weakest link and it is vulnerable to any shortcomings in its third party ecosystem – that is vendors, partners, contractors and suppliers – which can have serious consequences.[2]

• Compliance with new legislation – Looking specifically at the General Data Protection Regulation (GDPR), an organisation’s readiness to adapt to the new challenges of data privacy and reduced tolerance for data breaches represents both an opportunity and a threat. We expect data breaches to increase this year as hactivists or blackmailers expose data privacy failings, leading to GDPR non-compliance issues.

And, of course with Cyber Security – the theme of this year’s BCAW– there is the ongoing and growing threat posed by:

• Malware – Home Depot took six months to discover malware had been installed that allowed hackers to steal the data of 56m customers before the breach was identified. Making a bad situation worse, it transpired that the management’s attitude towards staff raising concerns over poor information security was “We sell hammers”.

• Cyberattacks – Hackers were able to gain entry to French media organisation TV5Monde and take down its social media, websites and emails. The reconnaissance took place over an estimated five months before the attack was launched and it was over two hours before the station regained some control. Overall, 12 TV channels were taken off-air for 18 hours.

Closer to home, Tesco suffered the largest cyberattack ever on a UK bank with some £2.5m stolen.[3] Quite apart from the reputational damage, Tesco faces a potential fine under the EU’s General Data Protection Regulations that could be as high as £2bn. The financial sector is four times more likely to suffer a cyberattack than other sectors and in 2016 there was a 40% increase in cybercriminal activity[4] targeting the financial services industry.

• Ransomware–This continues to increase with the FBI estimating it will become a $1bn industry this year.[5] However, its ‘success’ is largely due to the human factor. Social engineering and phishing are two of the criminal methods that hinge on poor personal behaviours or lack of awareness in the individual.

While many think the elderly are more vulnerable, they are by no means the only target. Younger people may be tech-savvy but they are also more inclined to be more trusting and unaware of the proliferation of threats and means of attack.With one in 20 Twitter accounts estimated to be a fake bot account, we should all be aware of the dangers posed by social media and sceptical of potentially fake sites offering too-good-to-be-true deals on the latest Raybans or tempting links on Facebook.

Despite increasing awareness of the cyberthreats, hazards and risks that abound, human frailties and impulses will continue to provide challenges to business leaders in 2017 and beyond.

[1]Sungard Availability Services Availability Trends Report 2016

[2]http://www.standard.co.uk/news/uk/nandos-diners-fury-as-restaurants-run-out-of-chicken-on-bank-holiday-a3432166.html

[3]https://www.theguardian.com/business/2016/nov/08/tesco-bank-cyber-thieves-25m 8.11.16

[4]https://cybernewsgroup.co.uk/merchants-and-financial-institutions-deal-with-escalating-cyber-attacks/

[5]http://money.cnn.com/2016/04/15/technology/ransomware-cyber-security/