Lessons Learned from Recent Breaches

Chris McKie – Dec 23, 2020

The recent series of breaches is perhaps the most significant cybersecurity headline of 2020, with one of the leading advanced threat detection vendors having exposed an apparent state-sponsored attack. As details of the breach unfold, the nexus between cybersecurity and risk management becomes increasingly evident, forming the basis of several lessons learned.

Third Party IT Vendors – Your Weakest Link in Security  
Over the last 10 years, IT departments have gained undeniable advantages and realized significant business benefits by utilizing third-party IT solutions. Rather than building costly on-premise IT infrastructure and services, agile businesses have reliably turned to third-party vendors, such as Amazon AWS, Salesforce, Microsoft and others to effectively and efficiently host, manage and provide mission-critical business and IT services.

Following in this practice, several organizations reportedly have been using third-party network performance, management and monitoring software, which appears to be the crux of these breaches. However, the fact that the breach potentially stemmed from any particular vendor is irrelevant. The fundamental issue here is that supply chain and third-party IT solutions present real risks to enterprise security architectures.

Lesson Learned – Implement Third-Party Risk Management Solutions
The proverbial ship has sailed when it comes to outsourcing IT services, and despite recent attacks, businesses have much to gain (e.g. cost savings, agility, flexibility, productivity, etc.) by using outsourced and cloud-based services. Knowing this, the prudent course of action is to implement a solution that reduces risk associated with third-party vendors.

One such solution is the MetricStream Third-Party Risk Management offering, which protects businesses from existing and potential third-party threats. Built on the MetricStream M7 Integrated Risk Platform, MetricStream’s Third-Party Risk Management product provides an integrated, real-time view of the extended enterprise. It strengthens resilience, contains costs and optimizes business performance by automating the end-to-end processes for information gathering, onboarding, real-time monitoring, risk, compliance and control assessments and risk mitigation.

Policy – Without Policy Security is Toothless
In the cybersecurity world, policy and policy management is often overlooked and undervalued. However, without policy, enforcement of enterprise security programs is futile and inefficient. We see this every day in society. We have laws to protect citizens, but without the police (policy enforcement), we would live in a lawless society.

Every breach is an opportunity to learn, strengthen security and become more resilient. Policy factors into this, and should be included as part of a post-breach review. In fact, most breaches are not nearly as sophisticated as these recent breaches, but are instead the result of employees not following security policies. For example, a spear-phishing campaign often succeeds because an employee clicked on a link embedded in a suspicious external email, even though corporate policy states not to do so.

Lesson Learned – Review Policy Management to Strengthen Security
MetricStream Policy and Document Management built on the M7 Integrated Risk Platform, streamlines and simplifies the creation and communication of organizational policies, while providing a centralized policy portal to store and access the latest policies. It delivers a contextual view to policies by mapping policies to regulations, risks and controls, thereby strengthening compliance while highlighting potential risks. Policy and Document Management raises awareness throughout an organization and brings policies to everyone, including first line employees, who are often the targets of cyberattacks.

Communications – Transparency is Critical to Recovery
One observation noted from recent attacks is the speed and transparency of corporate communications. Kudos to those involved, as often a breach is solely managed by Legal and/or IT. Whenever a substantive breach occurs, businesses face significant damage to their brand, sales efforts, customer success and partner base.

Not only do breaches potentially trigger lawsuits, but for many corporations, a material breach can also trigger SEC Regulation FD (Fair Disclosure) consequences. Cybersecurity incidents are often listed as part of corporate governance documentation relating to Regulation FD.

For those not in Legal or Corporate Communications, Regulation FD basically states that a corporation must prevent the selective disclosure of material, non-public information that could be used in the decision-making process of buying or selling a security. Depending on the severity of a cybersecurity incident, Regulation FD may apply.

Lesson Learned – Incident Response Must be Documented
Clear, quick and transparent communications is the way to best manage brand-challenging situations. Learning from their experience and response, every organization should have a PSIRT (Product Security Incident Response Team) policy in place BEFORE a breach or serious incident occurs. Response teams are usually comprised of different members within the enterprise, including representatives from Corporate Communications, Legal, IT/Security and the C-Suite. With MetricStream Policy and Document Management, creation of a PSIRT policy and process is simple and intuitive – a must have for any organization.

In conclusion, high-profile breaches will continue to dominate headlines, especially as more information is revealed about specific attackers, their processes, tools and techniques. From these, we hope to gain additional insights from what has transpired to find new and better ways to strengthen security and improve resilience. Clearly, more lessons are to be learned.