Contributed by Tenable, Inc.

Tenable, Inc., a company that provides cybersecurity solutions, recently released the Measuring and Managing the Cyber Risks to Business Operations Report, an independent study conducted by Ponemon Institute. It found that 60 percent of organizations globally had suffered two or more business-disrupting cyber events — defined as cyber attacks causing data breaches or significant disruption and downtime to business operations, plant and operational equipment — in the last 24 months. Further, the vast majority of respondents (91 percent) had suffered at least one such cyber event in the same time period.

Despite this documented history of damaging attacks, the study found that the majority of organizations (54 percent) are not measuring, and therefore don’t understand, the business costs of cyber risk. The report concludes that organizations are unable to make risk-based business decisions backed by accurate and quantifiable metrics, resulting in a lack of actionable insight for the C-suite and board of directors.

Digital transformation has created a complex computing environment of Cloud, DevOps, mobility and IoT, where everything is connected as part of the new, modern attack surface. This has created a massive gap in an organization’s ability to truly understand its Cyber Exposure at any given time. The research — which surveyed 2,410 IT and infosec decision-makers in six countries — found less than one third (29 percent) of respondents reported having sufficient visibility into their attack surface (i.e. traditional IT, cloud, containers, IoT and operational technology) to effectively reduce their exposure to risk. To further complicate this lack of visibility, more than half of respondents (58 percent) said their security function lacks adequate staffing to scan for vulnerabilities in a timely manner, with only 35 percent scanning when it’s deemed necessary by an assessment of risks to sensitive data.

Together, these data points reveal that the tools and approaches organizations are using fail to provide the visibility and focus required to manage, measure and reduce cyber risk in the digital era.

Of those organizations that measure the business costs of cyber risk, 62 percent are not confident their metrics are actually accurate. Thus, decisions about the allocation of resources, investments in technologies and the prioritization of threats are being made without critical information — such as the costs of IP theft, loss of revenue or loss of productivity. Organizations admit to not using the key performance indicators (KPIs) they consider important to assessing and understanding cyber risks:

• 64 percent rated “time to assess” an essential KPI but only 49 percent actually measure it
• 70 percent rated “time to remediate” an essential KPI but only 46 percent measure it
• Only 30 percent of respondents believe their organizations can translate cyber risk KPIs into actionable steps

This lack of rigor leaves boards of directors in the dark about the true cost of cyber risks to their organizations. Without confidence in the accuracy of their measures, CISOs and other security executives are reluctant to share critical information about the business costs of cyber risks with their boards.

“In today’s digital economy, cyber risk equates to business risk. It’s shocking to learn that organizations are suffering business-impacting cyber events yet are struggling to accurately measure the resulting financial cost,” said Bob Huber, CSO, Tenable.  “This study powerfully highlights that most organizations have not implemented security metrics that reflect cybersecurity’s role as a core business function. CISOs need reliable metrics to help them make educated decisions on the allocation of resources, investments in technology and the prioritization of threats.”

The report is available here: https://www.tenable.com/cyber-exposure/ponemon-cyber-risk-report.

The Reserve Bank of India (RBI) has imposed a fine of 10 million rupees ($1.4 million) on Indian Bank, a public-sector bank based out in the Indian state of Tamil Nadu, for violating cybersecurity norms. The central bank stated that the monetary penalty was imposed by an order dated November 30, 2018, for flouting of the Circular on Cyber Security Framework in banks.

“This penalty has been imposed in the exercise of powers vested in RBI under the provisions of the Banking Regulation Act, 1949 taking into account the failure of the bank to adhere to the aforesaid guidelines and directions issued by RBI,” an RBI stated in a statement noted.

“This action is based on deficiencies in regulatory compliance and is not intended to pronounce upon the validity of any transaction or agreement entered into by the bank with its customers,” the release added.

In order to advance the preparedness of Indian banks against cyber-attacks, the RBI is working on enhancing cybersecurity mechanisms. The central bank recently announced an enhanced security mechanism as part of its agenda for the fiscal year 2018-19 to provide high-level protection against cybersecurity threats.

The RBI’s new agenda includes taking effective steps to initiate the process of developing a cybersecurity culture, endeavor to make cybersecurity a responsibility, and ensure confidentiality, integrity, and availability of information system and resources. Also, to reinforce data protection and Know Your Customer (KYC) norms to make them more effective.

A recent study has revealed that a large-sized company in India loses an average of $10.3 million each year due to cyber-attacks, while a mid-sized company loses an average of $11,000.

The study named “Understanding the Cybersecurity Threat Landscape in Asia Pacific: Securing the Modern Enterprise in a Digital World,” conducted by Frost & Sullivan and led by Microsoft revealed that more than three in five Indian companies (62 percent) have either experienced a cyber-attack (30 percent) or are not sure about any cyber incident as they have not performed proper assessment (32 percent).

“Although the direct losses from cybersecurity breaches are most visible, they are but just the tip of the iceberg,” said Benoy CS, Director & Business Unit Head, Frost & Sullivan. “There are many other hidden losses that we have to consider from both the indirect and induced perspectives, and the economic loss for organizations suffering from cybersecurity attacks can be often underestimated.”

The study, that ranged from mid-sized organizations (250 to 499 employees) to large-sized organizations (more than 500 employees), surveyed 1300 businesses across different sectors. It also exposed the cyber-threats resulted in job losses in more than three in five (64 percent) of organizations.

“As companies embrace the opportunities presented by cloud and mobile computing to connect with customers and optimize operations, they take on new risks,” said Keshav Dhakad, Group Head & Assistant General Counsel, Corporate, External & Legal Affairs (CELA), Microsoft India “With traditional IT boundaries disappearing the adversaries now have many new targets to attack. Companies face the risk of significant financial loss, damage to customer satisfaction and market reputation—as is evident from high-profile breaches this year.”

The research also highlighted that 92 percent of organizations have either adopted or looking to adopt artificial intelligence (AI) to protect themselves from cyber-attacks and 22 percent of the organizations have already seen the benefits of using AI to detect threats faster and more accurately.

Google had earlier announced that it will be shutting down its social media platform Google+ for consumers by August 2019, after the disclosure of a vulnerability that exposed around 500,000 users’ personal information to third-party developers.

In a recent media statement, the California-based firm stated that it is moving the date to April 2019. The declaration came after Google+ encountered another data breach that exposed personal information of 52.5 million users. The tech giant admitted that the incident occurred due to an existing bug in its software update that was introduced in November 2018, before Google fixed it.

The flaw exploited Google’s APIs exposing users’ data, including usernames, email addresses, occupation, date of birth, age, gender, and other personal information. Google clarified that they found no evidence that any third-party developers were aware of the bug or misuse of any users’ data.

“We’ve recently determined that some users were impacted by a software update introduced in November that contained a bug affecting a Google+ API. We discovered this bug as part of our standard and ongoing testing procedures and fixed it within a week of it being introduced. No third party compromised our systems, and we have no evidence that the app developers that inadvertently had this access for six days were aware of it or misused it in any way,” the company said in a blog post.

“With the discovery of this new bug, we have decided to expedite the shut-down of all Google+ APIs; this will occur within the next 90 days. In addition, we have also decided to accelerate the sunsetting of consumer Google+ from August 2019 to April 2019. While we recognize there are implications for developers, we want to ensure the protection of our users,” Google added.

Earlier in November, Google had announced key security improvements to spruce the data protection measures of Google account users. According to Jonathan Skelker, product manager at Google, the search engine giant has been enhancing the account security by introducing a new step-by-step check-up, notifications, and JavaScript requirement.

Humble Bundle, a digital storefront for video games, recently revealed that it has suffered a data breach in late November that might have compromised the information like customers’ account details and subscription status. Humble Bundle is a distribution platform that offers game bundles, and sells eBooks, software, and other digital content.

The company stated that hackers exploited a bug used to gather the subscriber information in the company’s server and illegally gained access to its customers’ email addresses and their Humble Bundle subscription details. However, Humble Bundle clarified that no sensitive information such as customer name, billing address, password, and payment information was exposed in the incident.

The company notified its users via emails about the intrusion. “Last week, we discovered someone using a bug in our code to access limited non-personal information about Humble Bundle accounts. The bug did not expose email addresses, but the person exploited it by testing a list of email addresses to see if they matched a Humble Bundle account. Your email address was one of the matches,” the email reads.

“Sensitive information such as your name, billing address, password, and payment information was NOT exposed. The only information they could have accessed is your Humble Monthly subscription status. More specifically, they might know if your subscription is active, inactive, or paused; when your plan expires; and if you’ve received any referral bonuses,” the email further read.

Further, Humble Bundle apologized its customers and recommended some safety precautions to prevent the future losses. “Even though the information revealed is very limited, we take customer trust very seriously. We want to make sure you are able to protect yourself should someone use the information gathered to pose as Humble Bundle,” the email stated.

In related news, it was disclosed last month that a group of Call of Duty (CoD) players were a part of a cybercrime syndicate that remotely stole $3.3 million in cryptocurrency by hacking several crypto wallets.

Quora, a knowledge sharing website, recently reported a security breach to its users. The breach is expected to affect approximately 100 million users’ accounts on November 30, 2018.

The social platform wrote in its blog that a third party exposed users’ sensitive information, including names, email addresses, IP addresses, user IDs, encrypted passwords, user account settings, personalization data, public actions, and content such as questions, answers, comments, blog posts, and upvotes.

“On Friday we discovered that some user data was compromised by a third party who gained unauthorized access to one of our systems. We’re still investigating the precise causes and in addition to the work being conducted by our internal security teams, we have retained a leading digital forensics and security firm to assist us. We have also notified law enforcement officials,” Adam D’Angelo, the CEO of Quora, stated in a blog post.

Describing the incident as an identity theft, Adam D’Angelo, Quora CEO, stated that the company is taking additional steps to improve the security standards. “While the investigation is still ongoing, we have already taken steps to contain the incident, and our efforts to protect our users and prevent this type of incident from happening in the future are our top priority as a company,” he wrote.

Quora clarified that the questions and answers that written anonymously were not affected by the breach and they’re notifying the users whose data was compromised.

“Out of an abundance of caution, we are logging out all Quora users who may have been affected, and, if they use a password as their authentication method, we are invalidating their passwords. We believe we’ve identified the root cause and taken steps to address the issue, although our investigation is ongoing, and we’ll continue to make security improvements,” D’Angelo added.