Introduction
As a security architect in a service-industry organization, I have identified a cybersecurity threat impacting organizations. The need to pay attention to this problem is that it can have severe consequences for the company, which can lead to significant losses of resources and reputation. In this paper, I aim to draw the Board of Directors’ attention to the need to address this issue and to request resources to implement a mitigation strategy.
Description of the Cyber-Attack
First of all, it is necessary to pay closer attention to cybersecurity threats to the company. Hence, I have identified that the organization faces a phishing problem. The nature of this problem is that the attack occurs by sending malicious websites to users, employees, or customers via email. The issue is that “they may contain malware (such as ransomware) which can sabotage organizations or might be designed to trick users into revealing sensitive information (such as passwords” (National Cyber Security Center, n.d., para. 3).
Thus, the main goal of this cyberattack is to steal sensitive data and individual credentials. In this context, the likelihood that the organization will be affected is relatively high. This is because the intervention in the company’s activities is widely used and continuously evolving. Hackers are constantly finding ways to modify their activities to attack users. Consequently, many employees of the organization may become victims and unintentionally spread confidential information.
Potential Impact of the Cyber-Attack
To justify a budget increase, it is worth considering the potential impact of a cyberattack. Phishing is one of the most common cybersecurity threats and can negatively impact an organization’s operations. The organization’s financial resources are most affected, as information about its funds and banking credentials becomes a key priority. In addition, during this cyber-attack, the personal information of employees and the organization’s private data were obtained. Thus, financial losses can result from a breach of reputation and a decrease in customer trust.
Another consequence of a phishing attack that can harm an organization is increased susceptibility to regulatory fines and legal costs. This aspect also directly concerns financial losses that may result from the drain of customer data. As a result, there is a serious reputational issue stemming from the loss of trust not only from consumers but also from employees and stakeholders. This contribution also directly impacts the organization’s activities and profitability.
Current Level of Risk and Changes in the Risk Treatment
At the moment, the company is at high risk of exposure to phishing attacks. This is because, unfortunately, the organization pays little attention to this area despite the significant threat it may pose to its activities. In particular, the lack of regulation in this area and risk treatment measures may become a problem. Therefore, it is necessary to highlight the changes in the risk treatment that this implementation will facilitate.
The first step is to evaluate the existing strategy for mitigating the risk. This will provide an opportunity to identify the policy’s strengths and weaknesses, enabling a better understanding of the areas for transformation. In other words, managers will be able to focus on vulnerabilities and threats that could harm the organization.
Based on the information received, several changes to the organization’s risk treatment strategy are possible. Among them, the introduction of a new approach to limit the risk of exposure to cyberattacks and unauthorized access to credential data can be highlighted. Moreover, this process involves employee training initiatives that increase individuals’ awareness of hackers’ threatening tactics.
Proposed Countermeasure and the Process of Implementation
The proposed intervention for the organization is the introduction of a Multi-Factor Authentication (MFA system. It is a “layered approach to securing data and applications where a system requires a user to present a combination of two or more credentials to verify a user’s identity for login” (Cybersecurity & Infrastructure Security Agency, 2022, para. 1). To implement this technological innovation, a clear definition of organization’s current is needed authentication methods and determine which aspects should be changed and improved. The next step is for the IT department to develop a suitable MFA system for the organization, tailored to the needs of both systems and network access points.
One of the most critical steps in the initiative implementation process is the rollout of staff education initiatives. It is vital that “employees should be able to identify the basic signs of phishing emails such as strange or unexpected requests, often using alarming language or urging immediate action” (Cybersecurity & Infrastructure Security Agency, n.d., para. 3). Therefore, a clear and understandable explanation of threats from cyber-attacks, possible consequences and measures that they must implement on an ongoing basis to mitigate it. It is also important to continue monitoring the intervention’s effectiveness to identify potential changes.
Cost-Benefit Analysis of the Implementation
In conclusion, implementing the proposed intervention requires a cost-benefit analysis to substantiate the initiative’s needs and benefits. The expenses necessary for implementing the multi-factor authentication system include obtaining the required license. These can be Azure AD Premium P1, Azure AD Premium P2 license, or Microsoft 365 Business Premium (“What’s a conditional access policy?” n.d.).
At the same time, it is worth noting that this expense is among the least expensive, as it entails a small monthly fee. In addition, more significant expenses may require paying IT department employees to implement the program and conduct research on this type of change. Another item of expenditure is the allocation of a budget for monitoring, transforming, and introducing improvements to the strategy.
Despite the need for significant spending on the proposed program, it can have significant benefits for the organization. The main one is the reduction in the likelihood of exposure to a phishing cyber-attack. This risk reduction prevents unauthorized access and dissemination of private and financial information and data of users and the organization itself. In addition, after implementing the proposed strategy, the risk of a negative impact on the company’s reputation among consumers and stakeholders is reduced.
References
Cybersecurity & Infrastructure Security Agency. (2022). Multi-factor authentication (MFA).
Cybersecurity & Infrastructure Security Agency. (n.d.). Teach employees to avoid phishing.
National Cyber Security Center. (n.d.). Phishing attacks: defending your organization.
What’s a conditional access policy? (n.d.). GitBit.