Think Businesses are Only Hit Once by Cybercrime? Think Again
Letās begin with a cold, hard factāif a business has been targeted by cybercrime from an outside source, there is a 68 percent chance that another attempt to access their network will come within one year. This statistic comes from Crowdstrike, a cybersecurity solutions provider. Despite this reality, there seems to be a perception that thereās some unwritten rule somewhere that a company can only be attacked once.
Letās go over this discrepancy, and what it means your business needs to do.
Why Breaches are Commonly Seen as One-Off Events
Before we get into the data, letās tackle the crux of the matterātoo many businesses seem to have the idea that, if they are successfully breached by a cyberattack at some point, they are somehow immune to all cyberattacks from that point forward.
I hope I donāt have to tell you that this isnāt the case, especially as we just outlined a statistic that does just that. Instead, letās consider why the opposite is such a popular outlook.
Thereās the Misconception that Most Disasters Are Freak Events
Consider it for a moment: many disasters that we go over when we discuss business continuity planningāhardware failure, lightning strikes, and the likeāare often considered āfreak events.ā Theyāre those moments when circumstances happened to line up just rightā¦ or wrong, depending on how you look at it.
However, this simply isnāt the case. Take hardware failure, for instance. Thereās actually a formula meant to help manufacturers recommend inspection and replacement rates for specialized systems, like aircraft guidance systems. These failures are rare, but need to be anticipated, and so are expressed by calculating the mean time between failures, or MTBF:
Basically, you run an identical experiment on a set number of test cases, for a set amount of time, marking how long it takes for each test case to fail. Any that donāt fail simply get the duration of the test for that value.
You then add up the amount of time each one was operational (including those that didnāt fail) and divide that total by the number of test cases that failed during the experiment.
At that point, you have the average number of times that the test cases failed during the experiment, which you can then convert to a more meaningful timeframe to reference.
This doesnāt mean that the hardware wonāt fail sooner or may not fail for some time after the MTBF passes. Itās the average estimate, which means there canāand willābe outliers.
This Principle Applies to a Lot of Things
The same can be said of weather events. Contrary to the old saying, lightning does in fact strike twice. The Empire State Building website says that the iconic building is struck about 25 times a year (hey, look! Another average!). Consider Roy āHuman Lightning Rodā Sullivan, who was struck by seven lightning strikes between 1942 and 1977 and survived each time.
The thing about chance is that itās a numbers game, and different variables that apply to your business will influence these numbers differently. All most disasters are is the culmination of the right variables that contribute to a specific result.
Cybercrime, by comparison, works differently.
Why Cybercrime is Different
Returning to Crowdstrikeās data and the 68 percent chance of a second attack following a first, it only makes sense. Cybercriminals and the algorithms and strategies they utilize actively target low-hanging fruit. Businesses that were already breached once would certainly qualify as such in the eyes of the opportunistic cybercriminal looking to maximize their return for their efforts.
Fortunately, in the case of Crowdstrikeās data, those businesses attacked for a second time managed to prevent a second breach.
What This Means for Your Cybersecurity
Frankly, if youāve already been targeted by cybercriminals before, thereās an excellent chance that it will happen again soon after. This means that you need to ensure that your cybersecurity is comprehensively locked downāespecially, but not limited to, the vulnerability that let in the threat the first time.
The same really needs to be said for businesses that have not yet been breached. Complacency is not your friend in terms of cybersecurity, so it pays to be proactive and prepare to rebuff any incidents that you can.
Infradapt can help with our comprehensive cybersecurity protections and our monitoring services. Not only will we make it more difficult for threats to get in, but weāll also keep an eye on your infrastructure to quickly catch those that do. Reach out to us at 800-394-2301 to find out more.
https://www.infradapt.com/news/think-businesses-are-only-hit-once-by-cybercrime-think-again/
