Why Trust is the Real Target of Your Data Breach

As Dick Clarke reminded us in our recent webinar, the needs and concerns of today’s CISO are unique and ever-changing as we hear reports of a new data breach every week. CISOs, network engineers, threat hunters and other members of the cyber security team alike all work together for the common goal of protecting the organization’s data; however, your day-to-day concerns do differ. As the CISO, while you’re not intimately involved with the inner workings of your organization’s network, you have a bird’s eye view of the business, your employees, and your customers.

In this recent must-read, Trust War: Dangerous Trends in Cyber Conflict, Matthew DeVost, Neal Pollard, and Adam Segal walk us through the implications of breaches, not just on organizations, but on the people who entrust them with their data. It’s one thing to know what to do when your enterprise has been breached, but what do you do when the public’s trust erodes long after the data breach itself is over?

“Governments and industry already pour significant resources into security controls and privacy protections. Far less has been done to prevent the manipulation of integrity and data in institutions.”

Ask a CISO or CIO of the organization what suffered most after a data breach and their answers will vary. Maybe it’s the organization’s reputation, maybe it’s the network integrity, maybe it’s falling stock prices. But one of the more latent effects of these attacks is the loss of trust from those that relied on them to keep their data safe. After a breach, many institutions and organizations tend to “put more resources into trying to keep systems online and attackers out, than into protecting and restoring trust.” And this is a scary thought, the idea that stolen data may be the least of your worries. The long-term effects of breaches on the public consciousness should be top of mind.

Breaches don’t always disrupt operations – the scale varies. Sometimes breaches are caught early enough and the damage is kept to a minimum. But no matter how big or small, long after the attack is over its tendrils are pervasive, with the effects long outlasting the data breach itself as it continues to “undermin[e] the public’s faith in the systems they rely on every day.” 

Measures and regulations no doubt need to be put into place, but quantifying and measuring something as intangible as trust is a huge undertaking all on its own. Currently, NIST is working on methods and strategies in order to standardize, regulate, and measure the trustworthiness of institutions.

While this all might seem a little bleak, industry leaders remain optimistic. For example, in 2016 “the Pew Research Center asked over 1,000 technologists, scholars, practitioners, and others whether people’s trust in their online interactions would be strengthened or diminished over the next 10 years. Surprisingly, 48 percent believed that trust would increase.”

As the world evolves, so should the ways in which we approach it, cyber security included. All this to say, it is crucial to consider the perspective of those whose data you’re protecting. 

“We cannot have a functioning society without a sense of trust, and this is why it’s our greatest weakness in cybersecurity.” Consumers and citizens around the world are more educated than ever. They can research anything and everything within minutes, so if they put they choose you to keep their data and safe, show them they made the right decision.

You can read Trust War: Dangerous Trends in Cyber Conflict in full right here.