Maintaining confidence

Why IT security is important for preserving a good reputation

It’s not only critical comments on social networks that can threaten a company’s good reputation. Cybercriminals are increasingly using blackmail attacks to undermine confidence in companies, thereby damaging their reputation. However, there are countermeasures.

Text: Andreas Heer, Picture: Adobe Stock,

Customer confidence is a valuable commodity... and a volatile one, which needs to be carefully nurtured. To protect the good reputation of the company or brand, it is no longer sufficient today merely to respond to negative comments in social networks. Reputation management now also involves IT security. That’s because the risk of cyber attacks is increasing. If the online shop or even the company cannot be reached, the consequences are not just financial. Confidence in the company, and its reputation, will also suffer as a result.

The implications can be serious in the B2B environment, too – for example, if customer orders cannot be fulfilled because of IT failures, or even because confidential documents are “leaked”. This results in customers leaving and orders being lost. But this “worst-case” scenario does not need to happen at all.

Virtual attacks, real consequences

The development goes hand in hand: the importance of digital channels and processes has grown hugely in recent months – and so have the potential effects of a cyber attack. A glance at the relevant specialist media is all that is needed to obtain a picture of the threat situation. Practically every week, there are reports of new cyber attacks against Swiss companies. And that’s just the ones we even hear about.

 

The most frequent forms of attack by cyber criminals include extortion attempts using ransomware and DDoS attacks (Distributed Denial of Service), in order to paralyse parts of the infrastructure. However, the risk doesn’t just take the form of financially motivated attacks from outside the company. A data leak may even be caused by employees, who carelessly or maliciously allow confidential information to fall into unauthorised hands. Such unwanted data leakage therefore remains very high up on the security agenda.

Counting the cost of reputational damage

Cyber attacks are increasingly being launched with the aim of capturing confidential data. The consequences of a successful data theft are usually more than just legal and financial. There is also a risk of reputational damage, which can cause loss of revenue due to customers leaving. This is a risk that cyber criminals specifically exploit. For example, these days ransomware attacks no longer aim solely to encrypt data and extort ransom money in return for restoring it. The data is also exfiltrated beforehand, so that the attackers can use it as additional leverage by threatening to publish the captured information unless the ransom is paid. That is something that would prompt many a company to pay up, in order to avoid damage to their reputation.

 

And an incident of business e-mail compromise (BEC) doesn't exactly bode well for maintaining a good reputation, either. BEC is e employees receive an e-mail that purportedly comes from a member of the executive board and contains an urgent request for payment or an infected link. According to the Serious and Organised Crime Threat Assessment (SOCTA) by Europol, when something like this happens many companies fail to report the scam in order to protect their reputation.

 

A really sophisticated method was devised by a group by the name of “Fancy Lazarus” – it is unclear whether there is any connection with the advanced persistent threat (APT) group “Fancy Bear” or “Lazarus”. The cybercriminals send targeted e-mails threatening to launch a DDoS attack on a company unless the sum of usually two bitcoins is transferred to an account. However, according to IT security experts, not all threats are carried out.


Yet anyone who only looks outside for the enemy risks the same fate as the evil sorcerer Sauron in “Lord of the Rings”: he overlooks the danger within. According to the Verizon Data Breach Investigations Report 2021, depending on the sector up to 40 percent of incidents come from inside the company. When it comes to reputation management, data loss prevention (DLP) has a big role to play in preventing the leakage of confidential company information.

Reputation management as a strategic component

This is why reputation management should also be integrated into a company’s IT security strategy as well as its risk management system. The protective measures encompass various departments. The main precautions in reputation management include the following measures:

  • Protecting against DDoS attacks: This reduces the risk that critical parts of the infrastructure will fail, with the result that customer orders cannot be fulfilled. It prevents any reputational damage due to “unreliability” as well as possible financial loss.
  • Data Loss Prevention: This minimises the risk of sensitive data falling into the wrong hands, thereby reducing any loss of confidence in the company if a data breach has to be announced due to statutory or regulatory requirements.
  • Threat Detection and Response (TDR): This mitigates the consequences of a successful attack, for example by stopping ransomware before data encryption or exfiltration can take place. This prevents not only potentially high consequential costs, but also loss of reputation or even loss of competitive advantage resulting from the disclosure of confidential business documents.

Yet the complexity of reputation management is due not only to the protective measures required. The composition of the incident response team is also changing. In the event of an incident that threatens reputational damage, it also makes sense to involve the social media team and the communications department, as they are responsible for communicating with customers on social networks – proactively or in response to customer enquiries about the incident. This is helpful since honest communication is certainly a suitable means by which a company can preserve its reputation when negative incidents occur.

More on the topic: