5 ms·

Another noteworthy newspiece of large loss caused by a cybersecurity incident came from Clorox*: > the incident had disrupted portions of the company's IT infr

Another noteworthy newspiece of large loss caused by a cybersecurity incident came from Clorox*: > the incident had disrupted portions of the company's IT infrastructure... The company expects a loss per share of between 35 cents and 75 cents in the quarter ended on Sept. 30, and for net sales to fall by 23% to 28% from a year earlier. It had reported profit of 68 cents per share in the year-ago period. Still, you see CISOs fight tooth and nail to get a couple million approved for boosting cybersecurity posture. https://www.reuters.com/business/retail-consumer/clorox-expects-quarterly-loss-hit-cyberattack-2023-10-04/ https://www.reuters.com/business/retail-consumer/clorox-expe...

toomuchtodo 3y ago
The financial impact will continue until culture and budgets improve. The folks making these decisions are not sophisticated and competent in risk management. EDIT: @RugnirViking, my brother in christ, I agree with everything you said about culture.
- RugnirViking 3y ago
  > The folks making these decisions are not sophisticated and competent in risk management Aren't they pretty good at financial risk? isnt that like their only job a lot of the time? Idk it seems to me it must be possible to make a good argument for this stuff - How do cybersecurity consulting firms pitch to clients? Could McKinsey etc get in on it? It's just hard internally because a lot of the time it requires the culture to have been there from the beginning. Changing the culture if it's not present already is like trying turning a supertanker with a desk fan. People resent loss of freedoms, and operational restrictions prevent getting everyone to understand the whys
- dvh 3y ago
  No, it will not improve. They will be slowly replaced by companies with better security.
  - red-iron-pine 3y ago
    risk vs. reward. as long as they still control the bleach and misc. chemical market, it's just a cost of doing business.
- supportengineer 3y ago
  Perhaps SRE's would make the best CEO's
  - deleted 3y ago
    [deleted]
- wongarsu 3y ago
  "The company's shares fell 2% in extended trading after the outlook was released." That's a pretty mild impact. Multiply that with the low probability of this actually happening to a given company, and taking the risk doesn't sound sooo bad. Obviously it went wrong in this case, but it's hard to tell from the outside if that's because they did bad risk management or because they got unlucky on a calculated risk.
- cj 3y ago
  Is it a given that the loss isn’t covered by insurance? There’s always a balance of risk and the cost of mitigating risk. One way to mitigate risk is simply buying an insurance policy which in many cases may be cheaper than paying a security firm to protect yourself proactively. Cyber insurance often includes things like coverage for a PR firm to help regain as much reputational damage that may have been incurred. Many cyber insurance plans also includes coverage for paying ransoms. (I’m playing devils advocate somewhat, buying insurance to protect against cyber is something companies should do alongside of taking a proactive approach to securing systems)
  - toomuchtodo 3y ago
    I am responsible for negotiating a cyberinsurance policy for a fintech, and the marketplace is drying up due to risk repricing. If it was my money, I wouldn't be backstopping anyone getting underwritten unless I can plug directly into their controls and observability systems to confirm their risk posture, as well as have an internal (to the insurer) IR team. I'd probably also require quarterly IR tabletops and red teaming without prior notification required. Less around process and attestation, more about real world validation. https://news.bloomberglaw.com/insurance/as-cyber-insurance-dries-up-treasury-department-eyes-a-backstop https://news.bloomberglaw.com/insurance/as-cyber-insurance-d... (I have also provided comments to the US Treasury on backstopping cyberinsurance and perverse incentives around doing so)
    - cj 3y ago
      Typically when applying for cyber insurance you submit a questionnaire which includes questions like “do all endpoints us AV” and “Do you use IDS on your network” etc, etc. To a certain extent insurance shouldn’t need to verify controls if they’re able to have a company fill a questionnaire, and if their answers aren’t accurate the insurance carrier can use that as a basis for denying the claim. I would hope any federal program (if one comes about) works similarly. “We will only cover incidents if we can verify after the fact that you had these controls and mitigation measures in place prior to the attack”
      - 3y ago
Veserv 3y ago
As any competent security executive would tell you, even if they had a unlimited budget, complete management support, all recommendations followed, and total control over business process short of utterly crippling operations, the cost of hiring a hacker to completely breach the best possible form of their system would still be less than 1 M$. Oh, but what about the banks? Yeah, those are the security executives who personally told me and my colleagues that when asked. They literally have 100 M$ budgets up to 1 G$ budgets and they said that. The problem is not money, the problem is that commercial IT security technology and vendors do not work against professional, financially-motivated threat actors.
- wepple 3y ago
  I disagree. With sufficient buy-in and money, you can make your systems extremely difficult and costly to attack, making the economics of an attack not worth it. I’m willing to bet that a place like MGM has utterly abysmal security. You don’t see regular attacks against top-tier companies because a lot of them invest a reasonable amount.
- waihtis 3y ago
  You're not wrong, but reading the autopsies of most of these 100M dollar incidents suggest that having a slightly above average detection posture would eliminate most of the damage.
  - Veserv 3y ago
    Sure, in many of the post-mortems you can see that the attack probably only cost something like 10 K$ to execute. If their team did everything right they could literally make it 100x more secure. But that still only brings it to 1 M$. That is completely and utterly insufficient to stop the financially-motivated professional organized crime that are actively attacking them. This is not about theoretical attacks and threat actors, these are the people literally attacking them right now that they can not stop, that cause the most damage, and that can perform these attacks economically at 1 M$. To use the Caesar Entertainment incident that happened just before as a example, they purportedly paid a 15 M$ ransom. Is raising the cost to attack them from 10 K$ to 1 M$ really going to stop someone from collecting the 15 M$ payday? Oh no, I will only make 14 M$ instead of 14.99 M$, no point in attacking them. No, that is ridiculous. Making it harder is not a solution, you need to make it unprofitable. If it is profitable you will eventually be hit by a incident and that incident can be unboundedly bad all the way up to completely destroying your business. In addition, your susceptibility is not random. A targeted attack will succeed and will be wildly profitable to perform no matter what you do. This is not a "I need to outrun you, not the bear" scenario. The bear is very hungry and can catch both of you; it will eat the fatter and tastier one, not the slower one. Then it will catch and eat the other one. Your only protection is being less tasty so you get eaten last. You need to make it unprofitable and no extant solution available today in commercial IT can make it unprofitable for financially-motivated professional attackers. "Best practices" are maybe 1-10% of the way to minimally adequate; we need solutions 10 to 100 times better than the current gold standard to get there. Yes, I said times, not percent. We need a 1,000% to 10,000% improvement to get to the minimum bar. Until then, buckle in since things are just getting started; we are in for some real wild times on this ride.
red-iron-pine 3y ago
Clorox had been hit once before and had high levels of turnover & outsourcing. Not surprised it happened again. Most of their infra was 100% outsourced to HCL / Tata / Cognizant / etc., or their Mexican / Filipino equivalents. You get what you pay for.

toomuchtodo 3y ago

The financial impact will continue until culture and budgets improve. The folks making these decisions are not sophisticated and competent in risk management. EDIT: @RugnirViking, my brother in christ, I agree with everything you said about culture.

RugnirViking 3y ago
> The folks making these decisions are not sophisticated and competent in risk management Aren't they pretty good at financial risk? isnt that like their only job a lot of the time? Idk it seems to me it must be possible to make a good argument for this stuff - How do cybersecurity consulting firms pitch to clients? Could McKinsey etc get in on it? It's just hard internally because a lot of the time it requires the culture to have been there from the beginning. Changing the culture if it's not present already is like trying turning a supertanker with a desk fan. People resent loss of freedoms, and operational restrictions prevent getting everyone to understand the whys
dvh 3y ago
No, it will not improve. They will be slowly replaced by companies with better security.
- red-iron-pine 3y ago
  risk vs. reward. as long as they still control the bleach and misc. chemical market, it's just a cost of doing business.
supportengineer 3y ago
Perhaps SRE's would make the best CEO's
- deleted 3y ago
  [deleted]
wongarsu 3y ago
"The company's shares fell 2% in extended trading after the outlook was released." That's a pretty mild impact. Multiply that with the low probability of this actually happening to a given company, and taking the risk doesn't sound sooo bad. Obviously it went wrong in this case, but it's hard to tell from the outside if that's because they did bad risk management or because they got unlucky on a calculated risk.
cj 3y ago
Is it a given that the loss isn’t covered by insurance? There’s always a balance of risk and the cost of mitigating risk. One way to mitigate risk is simply buying an insurance policy which in many cases may be cheaper than paying a security firm to protect yourself proactively. Cyber insurance often includes things like coverage for a PR firm to help regain as much reputational damage that may have been incurred. Many cyber insurance plans also includes coverage for paying ransoms. (I’m playing devils advocate somewhat, buying insurance to protect against cyber is something companies should do alongside of taking a proactive approach to securing systems)
- toomuchtodo 3y ago
  I am responsible for negotiating a cyberinsurance policy for a fintech, and the marketplace is drying up due to risk repricing. If it was my money, I wouldn't be backstopping anyone getting underwritten unless I can plug directly into their controls and observability systems to confirm their risk posture, as well as have an internal (to the insurer) IR team. I'd probably also require quarterly IR tabletops and red teaming without prior notification required. Less around process and attestation, more about real world validation. https://news.bloomberglaw.com/insurance/as-cyber-insurance-dries-up-treasury-department-eyes-a-backstop https://news.bloomberglaw.com/insurance/as-cyber-insurance-d... (I have also provided comments to the US Treasury on backstopping cyberinsurance and perverse incentives around doing so)
  - cj 3y ago
    Typically when applying for cyber insurance you submit a questionnaire which includes questions like “do all endpoints us AV” and “Do you use IDS on your network” etc, etc. To a certain extent insurance shouldn’t need to verify controls if they’re able to have a company fill a questionnaire, and if their answers aren’t accurate the insurance carrier can use that as a basis for denying the claim. I would hope any federal program (if one comes about) works similarly. “We will only cover incidents if we can verify after the fact that you had these controls and mitigation measures in place prior to the attack”
    - 3y ago

Veserv 3y ago

As any competent security executive would tell you, even if they had a unlimited budget, complete management support, all recommendations followed, and total control over business process short of utterly crippling operations, the cost of hiring a hacker to completely breach the best possible form of their system would still be less than 1 M$. Oh, but what about the banks? Yeah, those are the security executives who personally told me and my colleagues that when asked. They literally have 100 M$ budgets up to 1 G$ budgets and they said that. The problem is not money, the problem is that commercial IT security technology and vendors do not work against professional, financially-motivated threat actors.

wepple 3y ago
I disagree. With sufficient buy-in and money, you can make your systems extremely difficult and costly to attack, making the economics of an attack not worth it. I’m willing to bet that a place like MGM has utterly abysmal security. You don’t see regular attacks against top-tier companies because a lot of them invest a reasonable amount.
waihtis 3y ago
You're not wrong, but reading the autopsies of most of these 100M dollar incidents suggest that having a slightly above average detection posture would eliminate most of the damage.
- Veserv 3y ago
  Sure, in many of the post-mortems you can see that the attack probably only cost something like 10 K$ to execute. If their team did everything right they could literally make it 100x more secure. But that still only brings it to 1 M$. That is completely and utterly insufficient to stop the financially-motivated professional organized crime that are actively attacking them. This is not about theoretical attacks and threat actors, these are the people literally attacking them right now that they can not stop, that cause the most damage, and that can perform these attacks economically at 1 M$. To use the Caesar Entertainment incident that happened just before as a example, they purportedly paid a 15 M$ ransom. Is raising the cost to attack them from 10 K$ to 1 M$ really going to stop someone from collecting the 15 M$ payday? Oh no, I will only make 14 M$ instead of 14.99 M$, no point in attacking them. No, that is ridiculous. Making it harder is not a solution, you need to make it unprofitable. If it is profitable you will eventually be hit by a incident and that incident can be unboundedly bad all the way up to completely destroying your business. In addition, your susceptibility is not random. A targeted attack will succeed and will be wildly profitable to perform no matter what you do. This is not a "I need to outrun you, not the bear" scenario. The bear is very hungry and can catch both of you; it will eat the fatter and tastier one, not the slower one. Then it will catch and eat the other one. Your only protection is being less tasty so you get eaten last. You need to make it unprofitable and no extant solution available today in commercial IT can make it unprofitable for financially-motivated professional attackers. "Best practices" are maybe 1-10% of the way to minimally adequate; we need solutions 10 to 100 times better than the current gold standard to get there. Yes, I said times, not percent. We need a 1,000% to 10,000% improvement to get to the minimum bar. Until then, buckle in since things are just getting started; we are in for some real wild times on this ride.

red-iron-pine 3y ago

Clorox had been hit once before and had high levels of turnover & outsourcing. Not surprised it happened again. Most of their infra was 100% outsourced to HCL / Tata / Cognizant / etc., or their Mexican / Filipino equivalents. You get what you pay for.