Although there are data breach notification laws on the books in 48 States that require companies to inform consumers about potential breaches, companies are loathe to make such disclosures.  In fact, a data breach disclosure opens the door to litigation, invites scrutiny from investors and the consuming public, and hardly bodes well for a company’s reputation.  But, the harsh reality is that, data breaches happen, happen often, and will likely happen with greater frequency as businesses and individuals become more digital.  Consider the below statistics:

  • In 2018, the total cost of cybercrime was estimated to be $600 billion, with more than 143 million US customers impacted (that does not take into account consumers outside of the United States). *
  • In 2018, $7.9 million was the average cost to a company to respond to a data breach.**
  • One in five small and medium businesses are targeted in cyber-attacks.
  • The average number of days that an “attacker” stays undetected in a network is 146.
  • The Federal Bureau of Investigations stated that losses caused by BEC scams doubled in 2018 and reached $1.3 billion, based on victim reports received by the agency’s Internet Crime Complaint Center.

When it comes to calculating the costs of a cyber-attack, there are many considerations you must take into account: the cost of any ransom you may be expected to pay, the cost of any data that may be lost, sustained system outages, downtime, non-compliance fines, legal fees – not to mention potential lawsuits.  And, if the above figures aren’t alarming enough, it was reported recently that business email compromise (BEC) has surpassed data breaches as the main reason companies filed a cyber-claim. In 2018, 23% of all cyber insurance claims insurance-giant, AIG, received were BEC-related insurance filings.

In fact, the Federal Bureau of Investigations stated that losses caused by BEC scams doubled in 2018 and reached $1.3 billion, based on victim reports received by the agency’s Internet Crime Complaint Center.

According to various secondary sources, the rise in BEC-related cyber insurance claims is directly attributable to poor security measures victim companies had in place.  But what is a company to do?  Below are some suggestions to consider to protect your email system and your system’s security.

  • Secure a Cyber Liability Insurance Policy (which often includes access to an array of experts should an attack occur).
  • Educate your staff – train everyone on email-based attacks, phishing awareness, suspect domain addresses.  And, after training, deploy tests to assess risk. Mechanical drawing incorporated by reference to MSA states Employees who lack the knowledge or training to avoid cyber threats are in positions to unwittingly put your company at risk by something as simple as clicking on the link in one phishing email.
  • Require complex passwords – those that require a combination of numbers, symbols, and capitalized letters – that must be managed/changed regularly.
  • Encourage all employees to implement different passwords for each online account they maintain/access (i.e., work email login vs. personal email login vs. credit card login vs. online banking login vs. Amazon login).
  • Implement advanced endpoint protection (i.e., those that protect endpoints against known and unknown threats).
  • Discourage use of public Wi-Fi.
  • Password protect thumb drives and other external media.
  • Implement a robust firewall that allows for site blocking and web filtering.
  • Devise an Internet usage policy.
  • Devise a computer use policy.
  • Consider email encryption where the email contains confidential information (protected health information, payment card data, Social Security numbers, dates of birth, phone numbers, email addresses, confirmation numbers, travel reward numbers – hackers want it all).
  • Require multi-factor authentication when using remote access, website logins.
  • Consider regular backups (i.e., hourly backups of data during business hours, and at least daily backups).
  • Ensure that backup is not connected to your system so as to not compromise its integrity in the event the system is compromised.
  • Deploy network penetration testing.
  • Implement patches as soon as available, and be sure to keep software and operating systems up to date.
  • Install a program that can remotely lock and/or wipe a lost device.
  • Create an incident response plan detailing steps to follow in the event of a compromise (i.e., who to call, what to do, what to implement).
  • Perform due diligence on all third parties and vendors with whom you work.

The above suggestions are hardly exhaustive but worth considering and implementing to create multi-layered protection for your small-medium business.

* See new report


For a particularly interesting article about cybersecurity and cyberwar consider reading, Warzel, Charlie, “The Privacy Project.” The New York Times, 10 Sept. 2019.