Bruce: Absolutely. In fact, small businesses are a more likely target than a Fortune 500 company. Hackers know that the large companies have a staff of IT people dedicated to protecting the organization’s network. They also have CISOs and risk management people on staff. Small businesses have none of these things, but still have assets worth taking.

Shiu-Kai: Yes. Cyber risk involves more than information. It includes the control of funds and information, i.e., the command and control of your business operations. If you lose control, your business operations will stop. Just look at the recent collapse of Colonial Pipeline operations.

Bruce: In my opinion, the cyber insurance market will increase. More companies are trying to transfer their risk and the best way to do that is by purchasing insurance. The main cyber insurance challenge is to determine what risks are covered by the policy.

Shiu-Kai: The challenges organizations and people have is adequately estimating cyber risk, i.e., how well a system is conceived, designed, implemented, operated, and monitored to assure mission-essential functions are available with safety, integrity, and security. Many risk methods are based on guesses in the form of probabilities of likelihood. The [research] by Romanosky, Ablon, Kuehn, and Jones of RAND have a devastating and amusing summary of the situation, after they reviewed cyber insurance policies: carriers don’t know to price cyber risk. The research we are doing with DoD, NSF, and relevant Defense Corporations applied directly to mission assurance, risk management, and certification of trustworthy systems.

Shiu-Kai: Mitigating cyber risk is much like mitigating risk in your financial operations. Just like you think about who touches or has access to your money and why, think about who touches and has access to your computer-based operations and why.

Think about the controls on your essential computer-based operations, transactions, command-control-and-communications (C3). Answer the question, “What controls are in place to assure that only those who are authenticated and authorized actually get to execute or deny those C3 operations?” If you think about authenticating and authorizing C3 operations as if those operations were money, you’ll be on the right track.

Bruce: Every business, regardless of size, should have a risk assessment done. Also, although they don’t need to employ a cybersecurity specialist full-time, they all should have one on retainer.