We Reveal Why Organisations Miscalculate The Cost Of Insider Breach

Action.

Hello, everyone. Happy Thursday and greetings to everyone. We've got a special guest with us, Andrew Bycroft. Good to see you again, Sean. And all the other ones that have turned up. Yeah, I've known Andrew for quite a few years. Andrew. I think around what, 10, at least 10 years from your 48 days, Andrew.

12 years.

Oh, wow. Time flies by. Andrew runs his own business called Iresilience. He's actually the CEO of a very successful business. He's written two books. One of them is the Sari Intelligence Executive and that which is actually I read a really. And it was an excellent book. So can people still get this?

It's a bit hard to find. It's out of print at the moment, but I might actually have to do another program.

Okay. And then your second part is Adapt or Die, also a good book, but that was co hosted with Mr. Sharma.

That's right, yeah.

So Andrew, what I know about Andrew is a great, well, he's a great thinker and a great strategist, you know, from all the years that we've known each other. So I love, you know, sort of knocking on your door and getting your thoughts and ideas about where cyber security is going, particularly more from a cyber resilience. We tend to think alike. So I know you have a unique approach to the way you approach problems. I know that you know, when you go and visit organizations and identify what the problems you, you bring, what you have, but you also identify what's common and you look for ways that you can actually move forward. I think it's great. And these two books really identify what makes you unique and different. But more importantly, you've also developed models, your costing models, which, you know, audience would love to hear more about it. But before I do that, is there anything that I've missed in terms of telling the world who you are?

I think that was probably a good introduction, Boaz. I guess in recent times, just to add to this, in recent times I've moved beyond cyber. So what I found was as I started to strategize on how to better represent CISOs and chief risk officers in their plight to obviously combat cybercrime, I realized that the underpinning problem was culture. And by actually helping organizations tackle that cultural element, I was actually helping them fix other issues as well. So, for example, problems with their accounting practices, problems with their third parties, dealing with third parties, third party risk and so on, and even much more broad problems. I mean, one of my clients actually was trying to understand how they're going to tackle Cyber, sorry, not cyber, climate change. And by looking at the cultural elements again, they were able to quickly get some ideas in place to help combat that. So, yeah, so cyber is obviously my background, but I've actually broadened and that's why I've gone with the name of resilience, because resilience can actually work across pretty much every aspect of the business.

Yeah, I like it very much. So look, the crux of this discussion that we, and the reason why we have you here is we really want to have a discussion about what is the real cost associated with the breach. So whether it be an insider breach or cyber breach, I know that you've written and developed an application specifically targeted about that. It's very interesting. I've had a look at it, I think some 12 months ago, I very much liked it. But why don't you explain in your own words what it's all about?

Okay, so before I talk about the issues with site service and chief risk officers now, one of the biggest problems they face is the ability to get the budget that they need to deal with cybercrime. And in obviously facing that, the biggest drawback is they're not getting a business case in the right language to the cfo, the chief executive officer or the board of directors, which basically means they get overlooked, they don't get the budget they need. So what I devised was a way to create a one page business case which is based on quantifying the risk of taking action and how that is reduced compared to not taking action. So basically we provide a financial overview, a bit like a balance sheet that actually shows the benefits to actually moving forward with addressing that particular risk. And I actually was a bit cheeky as well and I actually put a figure in there which actually looks at how quickly that payback period is and how if they don't take action, how much of the CEO's salary that could potentially impact as well. So it actually really hits home pretty hard when the CEO realizes just how much they have to lose from their salary, from their bonuses if they don't actually take action.

Well, sorry for doing interrupt you, but I think one of the most difficult challenges that this industry has is about identifying what's the return on investment when they invest in any security technology. And there's been things like floating around about, oh, let's see how many cyber incidents that we get that's not real what I call a return on investment. I mean, Sean, when we talk about it from a return on investment, we talk more from a deterrence, correct? Dave?

Yeah, look, the question is, when organization invests in so many solutions, do they really know in figures what they are solving? What are the risks that the financial risk or the dollar risks they have when they have these solutions in place?

Well, yeah, the question is that they don't really actually fully understand that, which is why most IT departments will actually result to those heat maps or subjective terms such as high, medium and low because they don't actually know how to quantify it. In fact, many times they will come back to me and say we don't have all the data that we need to quantify risk. And I actually agree with them. In fact, they don't have all the data, but collectively across the entire organization, the data is there. And it involves actually collaborating, talking to hr, talking to finance, talking to risk, talking to pr, marketing in order to get all of that information so that we can actually quantify the risk properly.

So, so okay, when you approach your clients, what is usually the obvious they look at and what's the non obvious when when it comes to calculating saga risk?

Well, the obvious areas are obviously anything to do with operational impacts. Now those are the things which are pretty obvious. So for example, we can't access the server, we can't do our work right now, we can't send these documents. All of those have an immediate impact and they start calculating the cost of lost productivity. What they tend to pick in is the medium term financial impact. So for example, let's say we're going to go and notify a client that there's been a breach. Well, there's a cost of actually notification. So you might find for example that you've got to go and call 10,000 clients. You might also have to call another 10,000 shareholders, for example, to notify them as well. If you are a publicly traded company, in some cases you might not actually have telephone numbers for all these people. So you might actually have to resort to other tactics such as email or even snail mail. I spoke to one client recently and they identified that the best contact they had for all of their customers was snail mail. And if they actually had to alert all 300,000 customers, that would actually be 300,000 postage stamps. So that's already $300,000 in postage plus then there's a cost of the envelopes, there's a cost of the paper, the cost of printing. So it actually adds up all of these financial costs and those often get overlooked. And then there's the longer term costs as well, such as reputational damage. So here we're looking at the loss of leads, basically clients or potential clients that would have purchased from you, but all of a sudden they've got cold feet and they've gone elsewhere. Then there's the actual cost of lost clients, there's potential share price drops as well. If you are a private company, perhaps you've actually got investors that invested some money in you and all of a sudden they actually want to pull out, they don't want to be associated with anymore. Or maybe you're actually looking for an additional round of investment as a smaller private company and that door is suddenly closed to you.

So basically, okay, say there are many impact levels to any incident. So there is a direct impact, which is the obvious. You know, the CRM died. Well, we need to get that CRM back live. So we look at the server itself, we don't look at all the users or the internal users that need to use their CRM for work, which means they are now not doing work. They're not working, they're staring at the screen or playing YouTube. Also, there is less communication to clients, there is less communication to suppliers. Suppliers cannot release their goods, you cannot bill them, you lose the money because you couldn't build them on time. It goes to the next quarter, financial statements goes bad, etc, etc. So there are different level of impacts. And as you say, most of organizations looks at the obvious which is easy to identify. So who do you think should run these analyses or who should hold that information within the organization?

That's a really good question. And it does depend on the organization, depending on the kinds of roles they've got. But I believe that it's not an IT problem, it is more of probably finance it's type problem. So typically I would suggest that the CFO runs with it because at the end these operational impacts, these financial impacts and reputational impacts all have costs associated with them. So it does actually obviously impact the balance sheet in the end. So I would say the CFO is probably a good place to start. In some organizations the CFO might not be as interested in running these sorts of analyses and therefore they could actually delegate to someone like the CRO who would obviously also have an interest in in that area. Ultimately what comes out of one of these analyses though should actually be reported up to the CEO and the board of directors.

Okay, so Andrea, are you able to just explore a little bit more about the impact to the organization? What are the different types of impacts that as a result of a breach?

Yeah, so I mean obviously we talked about the operational impact, so Those range from anything to do with people not being able to do their work to obviously availability impacts, service are down, people can't access the building, maybe the building's been destroyed by flood or something like that. So there's lots of reasons there why people can't do their work. And effectively what we're doing is we're calculating the cost of downtime, then we have our financial impact. So this is anything from where we've got, for example, legal or contractual breaches. So for example, a cyber breach may have impacted the ability to go and meet contractual obligations and therefore there are penalties associated with that. There could also be regulatory breaches and there could be again penalties associated with that. We also have the cost of what happens if we need to go and operate out of a Dr. Site. For example, what if we don't have another office that we can work out of and we actually rent business continuity seats? So again, there's costs associated with that. But not only that, when we actually are in a crisis, for example, we might actually have people working around the clock. We might actually have to employ additional people to go and help, for example, man the phones to go and answer calls from worried customers. Also we actually have, because we've got people working potentially overtime, there's the cost of travel, there's a cost of meals, maybe accommodation, maybe, for example, your Dr. Site is actually quite a distance away from where people would normally live and therefore they actually, in order to help with recovery, they're actually having to stay in hotels. So there's actual costs associated with that as well. Then we've even got the cost of, for example, counseling. Maybe there's been some sort of trauma involved. In some cases, for example, where there may be SCADA systems involved, there could actually even be safety issues. People could have actually become injured or even there could have been fatalities. And there's a cost associated with that as well. And then finally, when we get to reputational ones, we talked a bit about these before, but again we have those share price drops, the cost of lost customers. There's also the cost of what happens if we lost business partners and we have to go and source additional business partners, maybe some third parties that we've got good relationships with at the moment who are giving us better than average prices. Maybe we've lost that ability to work with them and we have to go and seek additional partners and perhaps there's a price increase there. We've also got, for example, insurance excess increasing as well. We make a claim, all of a sudden our premiums go up and we've got that excess there. And of course, one of the interesting factors as well is when we do these analyses, most of the time insurance is going to only pay back a port, the actual true costs of the actual bridge.

So the question then is why aren't organization sort of when they're strategizing in terms of their security thinking, don't look at what's the worst case scenario, what's the downtime, what's going to be the cost of business as a result of a breach. It's very much a situation where they say, well, we need certain technologies, let's tick, let's be compliant. But they don't use a model where, like what you have to drive some better syncing and better outcomes. Why is that?

I think it's probably a few reasons. One is that they probably don't know that there is a way to quantify risk. That's probably the primary reason. The second one is that perhaps when they're actually purchasing solutions, they've actually got the vendor coming back with some sort of justification as to how this is going to pay off from a return on investment perspective. Of course, a lot of those analyses that vendors do are quite biased. And for example, they won't factor in all of the costs with implementing the solutions. So for example, they'll cover the hardware costs, the software costs, licensing, maintenance costs, but they won't factor in the fact that you may actually have to recruit additional people in order to manage and maintain those systems. They won't factor in documentation costs and what happens if, for example, outside of warranty periods, repairs need to be done. They won't factor in all of those potential costs as well. So those models tend to be quite biased in favor of the vendor to make it look like the solution costs are minimal, whereas there's a huge upside there because the costs of a breach are quite high. So they'll factor in some of those, but again, they're probably not factoring in much beyond the operational costs. What I've found is that in most breaches, the operational costs account for somewhere between 4 and about 10% of the true costs of a cyber breach. Oh, wow.

So what would be the benefit of an organization if they started off with understanding what's the potential downside? And so how could that help them develop this thinking and be better prepared?

Okay, so what it's going to do is it's going to allow them to see the actual cost of what could happen. And what we do is we don't actually Give like a true figure, because we can't know. We don't have the ability to know precisely how much it's going to cost. What we do is look at plausibility and we have a range. And people will say, well, a range is not that accurate. But then again, if you look at, for example, look at the weather forecast, we could say tomorrow's going to be hot, which is obviously very subjective. I mean, if I just spent a day in Antarctica, then hot could mean zero degrees Celsius. If I'd spend a day in the desert, the prior day, then hot could mean 100 degrees. So it's very subjective. But if you look at the weather forecast actually give you a range, it could be a minimum and maximum. And you know that the temperature is going to be rain. And it's the same with this as well. So I can give you a best case and a worst case. And typically, obviously the median point is going to be what it's roughly going to cost you. So from that you can obviously understand how much it will cost you in the worst case scenario. And even the best case scenario, if you want to be conservative, then go with the best case numbers, which is usually still quite compelling. Because in the end of the day, if you start looking at what that's going to do in terms of your revenue, your profitability, that those figures simply make a CFO quite scared. Now, what we also do is we look at confidence intervals as well. And what we're asking people to do when they do these analyses is give me your 100% estimate. So, you know, the 100% chance that the number of incidents you're going to have is going to be between this minimum and this maximum. So, yeah, can be quite a wide range, but there's a 100% certainty of that. Of it being somewhere within that range.

Yep. Okay, so organizations, then, if they go through this exercise, they get a figure from a minimum to maximum. What do they do with it? How does it benefit?

Okay, so what they do with that, they get basically three numbers at the end. The first is a risk reduction percentage. So how much can we reduce your risk by as a percentage by taking up this particular solution? The second one is what kind of efficiency gains can you get? So if we think about it, if you're actually reducing risk, then effectively what you're doing is you're increasing the uptime of systems and you increase the productivity of people, which means you're going to get certain operational efficiency gains by mitigating that risk. So what we'll do is we'll also calculate the efficiency gains that you'll get by implementing that solution. And then the last figure is the return on investment. So again, if we look at efficiency gains, if you're consistently getting efficiency gains because you're mitigating risk, that's going to mean you're going to get a better return, you're going to get better utilization out of those systems and those people, which means you will get a return on investment. So again, we give a figure. There's. And what surprises some people is they realize that the solution that they're putting forward is not actually the best solution. And in some cases we've found a negative return on investment, which means they need to go back and look for a different solution. Or in some cases, maybe there is no solution because you can't actually mitigate that risk effectively with spending money. It's actually, you're better off actually wearing the cost because it happens so invariably and impact is so small.

So basically, Andrew, when you say such an assessment or such a service or calculation can actually help a lot of organizations before they apply or consider new solutions and new approaches because they can actually put a price tag to that number price. Today I would call it a silo accountant, but it's really do the right accounting for organization. When they run the business money, obviously the CFO and the accounting firm take care of the money and they have the company, they have the full visibility of what's happening to their money, but they don't know what's happening to the IT money or the operational money within the organization. They work based on a lot of assumptions. And when you talk about return of investments, well, every vendor almost comes with that return investment, how much my solution cost and when you will return it. But I guess it's not true because there are so many other collateral impacts outside the focus of that product that can impact the organization. You know, ease of use, complexity, you know, even the tiny things that the vendors don't think of. And obviously they will not highlight difficulties. Also, they don't do the corporate assessment, they don't do the full organizational assessment. So how come they say it's a return of investment? They don't know what are the bad impacts or the good impacts of those solutions. So what you say that you come to organization and actually what they do calculating before they apply any solution, just to make a justification to make sure that this is the right investment for them. Until now, if they don't calculate, they don't know if the right investment they just look at the operational, whether it's work or not. But there are many other solutions that can work or other options that can work better. So what you say, focus on what IT cost. Because the end of the day, any organization works for profit. If they don't make money, they lose money. So anything that they put into the organization should be profitable for them or should help the organization to be profitable.

That's one of the issues. I think it is basically written off as a cost center. I know that there's going to be a cost of doing business in terms of cyber breaches, but by actually understanding the numbers and planning ahead of time, then you could actually turn that into a profit center rather than a cost center. But it's a way of looking at cyber security as being an investment rather than a cost. And the bottom is too few organizations look at it as a cost, which means when they actually come to balancing the numbers to see if it comes to balancing the numbers, that whole section is just written off on the books. But if you could understand it ahead of time, you could certainly change that. And in fact, what's interesting as well is we can even go back and look at the cost of past breaches as well. We can go back and look at the data and look at a past breach, and that can also provide some indication of what a future breach might cost.

So basically, we can turn the IT as a cost to, basically in some instance to an accelerator. So if we do it right, it basically help and improve the organization's efficiency and productivity and make it more profitable if we do the right decisions.

That's right, yeah. I mean, the key is to show that there is a return on investment there, that whatever solutions you're putting in place do actually have a payback period well within the lifecycle of the solution. And not only that, the next thing to look at as well. And this is a lot more difficult to quantify, but obviously we talked about if you consistently get risk reduction, you get operational efficiency gains. If you consistently get operational efficiency gains, you get return on investment, you consistently get returns on investment. That actually gives you a competitive advantage. So that's the next factor to look at as well. What can we do in terms of competitive advantage by actually understanding the risk, quantifying it, finding the right solutions, and getting that right return on investment. So eventually you do get your competitive advantage.

So data setups as a planning tool or forecasting tool, you know, just to do some cost exercise before taking decisions.

Yeah, that's the most common way to use it actually more as a forecasting tool to actually look at what could happen. And again you can run multiple analysis. So you can look at, well, what happens if, for example, we lost 10 clients and we went with solution A, what If we lost 20 clients and we went with solution B and we can start comparing as well until we find the right solution for that problem.

Yeah, Andrew, so for those organizations that want to do something, how would you recommend them to start? Where would you recommend them to start?

Okay, well, probably looking at some of the simple costs. So one of the more interesting ones that we modeled recently with a client was around rates of where should I pay the ransom or should I actually recover from backups? What's interesting is in most circumstances it's actually cheaper to pay the ransom because you actually get the business operational very quickly. But over the longer term that doesn't pay off. So initially that sounds like a good measure. What that does of course is it actually increases your likelihood that you will be attacked again and again because all of a sudden you've raised a red flag and say we don't have any other solution to address this, we're just going to pay the ransom. Correct. So after Perhaps somewhere between 10 and 15 incidents, then it actually becomes more costly to keep paying the ransom and to recover from backups. Again, it depends on the type of backup solution you've got. Well, if you've got a tape backup solution, well, it's going to take a lot longer to restore the data than if you've got a disk based solution. And in recent times as well, there's been a lot of technology changes around real time backups, real time restoration. So in some cases it depends on the solution. But that was a more interesting one to model. But I would say the best place to start is pick something simple that is very likely to happen and just look at what it could potentially cost you and you can start looking at what happens if it really does have a huge reputational impact on us. What happens if it does alter the share price? What happens if it does mean that investors pull out, that we do lose clients, business partners and so on.

Okay, so I've got a follow up question which is quite an interesting. It's the debate between cyber incident versus insider incident. Would you be able to quantify whether there's a difference in terms of costs?

Yeah, absolutely. Because when it comes to insiders, obviously they've usually got a lot more access, they've got a lot more privileges and that means potentially there's going to be a Lot more damage. There's. And if obviously whether that leaks, that could also impact future employment prospects. So you might find that people don't want to work there in the future. You might find it harder to attract new talent if word of that got out that insiders were not to be trusted. Also that may actually cause a shift in the culture of the organisation as well and make it a much more difficult place to work because all of a sudden the senior management team won't trust anybody because of a single insider breach. And that's going to have further impact, which again we can quantify and we can look at.

Excellent. Is there a specific industry that is more prone to having a bigger damage, a bigger harm as a result of.

A breach.

That you think that you've come across?

Yes. So, I mean, I did a model recently for Department of Defence and they looked at the cost of a laptop computer with top secret data being stolen overseas in a hostile country. And that was a massive cost, just again, depending on the type of data on it. But in some cases that top secret data means you may actually even have to relocate people. So relocation costs come up as well. So that's certainly a tough one. Anything where there's for example, blueprints, trade secrets, very valuable intellectual property, those ones can certainly be quite costly. And for small organizations it tends to be more, not so much around reputational damage, but more around the operational impact. In their case, operational impacts are quite high because if they lose too much productivity or they might not be in business for much longer.

Yeah, okay, excellent. Sean, do you have any other last questions that you wanted to ask? Yes.

So basically when our organization uses your service, Andrew, it helps them to put a price tag almost on everything in the organization, right? So they can really understand the dollar value of any existing process or existing asset. And what is the potential loss in dollars for that asset, Is that correct?

Yeah, that's correct. So if you look at not only asset costs, but what does that mean to your organization as well, if that's lost? Because I mean, data is a very hard thing to call it.

Any existing process or existing.

In terms of its value, I mean, quantify it in terms of the time it took to input it, the time it would take to re input it again if it was lost. But also what is that data worth? So for example, let's take the iPhone blueprints, for example. Those are worth billions of dollars. It might have only taken five minutes for someone to come up with a design and put it into a computer. But if you looked at just the productivity costs associated with that, that would be quite small. But the actual, the fact that those blueprints have created billions of dollars of products means there's a natural cost associated, it's a natural value associated with those. So we factor in all of that information.

It could be just a Coca Cola formula that you can put on one page and that costs billions.

Yeah, right.

Your KFC as well.

You touched a very sensitive point here, Andrew. If someone wants to use your service, how do they do that?

Well, probably the best way would be to contact me through LinkedIn, connect with me on LinkedIn and we can have a discussion around how you want to use it and see whether it's something that might benefit you.

How long such a problem, how long such an assessment could take for organization?

Well, it might take a few days of meetings just to work across the entire organisation to get all of that data. As I said before, it's not just it, we've got to talk to hr, we've got to talk to finance, marketing, pr, sometimes even the board of directors and the executive team as well to understand what their involvement might be in a particular bridge. So and therefore having scheduling all those interviews can take some time, but it usually adds up to usually a couple of days and it could span across a couple of weeks depending on availability of people in order to get that information. And then what we do is we put it in the tool and we actually show you a report at the end, a one page report, but also we've got lots of charts as well for people who graphically minded they can actually get in. Scheduling all those interviews can take some time, but it usually adds up to usually a couple of visualizations. But then there's also the detailed science behind it as well. And we provide all that. We're completely transparent as to how those numbers came about.

A question from the guys here, Andrew. How do you correlate the costing model with the KPIs of an organization so they keep performance index as such?

Okay, well we don't take too much data in the form of KPIs. What we do is we do look at for example, things like risk tolerance and we do look at things like for example sales quotas, we do look at days for payment of invoices and things like that to see whether those things could actually be breached, for example. So let's say for example, you're penalized for not paying invoices in time. Well, we can look at what happens in those circumstances, but in terms of measurements against KPIs, as in, for example, would someone lose their job? We don't actually have a calculation there, but that's certainly something that I could probably look at getting developed into the tool.

Okay, Andrew, is there a question that we should have asked you, but we haven't yet. Is there something that you want to add to what we've discussed so far, or just maybe just a brief overview of the application that you've developed? Is it available?

Yes. At this point in time, we don't sell it as an application. We more or less sell it as a service. So we actually come in and help you model the scenarios. I mean, you certainly get access to it, but it usually takes professional services as well to help get the information. And we found it's because businesses obviously have silos, and it's very difficult, for example, to get one person to go and talk to someone else in order to get that information. So we act more like facilitators to work across those silos, get information, put it in. And before we actually run the model, we get people to confirm that the data that we've put in is actually what they've provided us so that they can't turn around and say, well, I don't know where that number came from. They validate that numbers come from them and that they're confident that's the right number. In some cases, obviously they don't have numbers, so we might sit down with them and actually look at what is plausible. Or we might actually go and look at, for example, actuarial data which has measured what other clients in that particular industry have seen before when they've had a similar situation. So in some cases we may suggest information, but again, we'll actually explain. We suggest information that this hasn't come from the client. This is actually data that we believe would be accurate. If you had this particular scenario.

Excellent, Excellent. So I think Sean had asked the question, but. So people can connect to you via LinkedIn, would that be correct? That's the best way for them to reach out to you?

Yeah.

Put your details down there on the. After the recording, we'll put your details on the comments so everybody can reach your account. But I think. Buzz. I think we touched it. Buzz.