Weakness is a better teacher than strength ... - PDF Archive

318 Chapter 9
• Value to adversaries: How much is it worth to an organization to know what the
competition is doing? Many organizations have established departments tasked with
the assessment and estimation of the activities of their competition. Even organizations
in traditionally nonprofit industries can benefit from knowing what is going on
in political, business, and competitive organizations. Stories of industrial espionage
abound, including the urban legend of Company A encouraging its employees to hire
on as janitors at Company B. As custodial workers, the employees could snoop
through open terminals, photograph and photocopy unsecured documents, and rifle
through internal trash and recycling bins. Such legends support a widely accepted
concept: Information can have extraordinary value to the right individuals. Similarly,
stories are circulated of how disgruntled employees, soon to be terminated, might steal
information and present it to competitive organizations to curry favor and land new
employment. Those who hire such applicants in an effort to gain from their larceny
should consider whether benefiting from such a tactic is wise. After all, such thieves
could presumably repeat their activities when they become disgruntled with their
newest employers.
• Loss of productivity while the information assets are unavailable: When a power failure
occurs, effective use of uninterruptible power supply (UPS) equipment can prevent
data loss, but users cannot create additional information. Although this is not an
example of an attack that damages information, it is an instance in which a threat
(deviations in quality of service from service providers) affects an organization's
productivity. The hours of wasted employee time, the cost of using alternatives, and
the general lack of productivity will incur costs and can severely set back a critical
operation or process.
• Loss of revenue while information assets are unavailable: Have you ever been in a
retail store when your credit card would not scan? How many times did the salesperson
rescan the card before resorting to entering the numbers manually? How long did
it take to enter. the numbers manually in contrast to the quick swipe? What ifthe
credit card verification process was off-line? Did the organization have a manual process
to validate or process credit card payment in the absence of the familiar approval
system? Many organizations have all but abandoned manual backups for automated
processes. Sometimes, businesses may even have to turn away customers because their
automated payments systems are inoperative. Most grocery stores no longer label
each item with the price, because the UPC scanners and the related databases calculate
the costs and inventory levels dynamically. Without these systems, could your grocery
store sell goods? How much would the store lose if it could not? It has been estimated
that "43 percent of all businesses that close their doors due to a disaster or crisis, even
for one day, never reopen them again. An additional 28 percent fail during the next
three to five years.,,4 Imagine, instead of a grocery store, an online book retailer such
as Amazon.com suffering a power outage. The entire operation is instantly closed.
Even if Amazon's offering system were operational, what if the payment systems were
offline? Customers could make selections, but could not complete their purchases.
While dotcom businesses may be more· susceptible to suffering a loss of revenue as a
result of a loss of information, most organizations would be unable to conduct business
if certain pieces of information were unavailable.
Once an organization has estimated the worth of various assets, it can begin to calculate the
potential loss from the exploitation of vulnerability or a threat occurrence. This process