Hey #infosec,
what's your best answer to people telling you "But we're not a Bank!" whenever you plan to introduce any measure to lower a risk?

@Newk
Reminds me of a story a friend told me. He got a call to assist a small manufacturing company that had been hit with ransomware.

He met with the lady who owned the company. Her husband started the company over 30 years ago. Had somewhere around 40 employees. Successful business. Husband passed a few years previous.

This was her husband's legacy. Friend helped and brought in 3rd parties to restore their systems. They lost the majority of their data including customer billing details, plans for their products, documentation, etc going back to the founding of the company.

Took nearly 3 months to "recover". Friend meets with her and she admits they were within about 72 hours of shutting the business down permanently. Bye bye husbands legacy.

So he starts talking to her about cyber security planning, etc. She tells him she's not interested. She figures that since they survived this then they could get through it if it happens again.

He lost his shit with her and basically told her never to call him again.

@mrclark @Newk This can be a reasonable risk assessment though: take a worst case scenario, if you can recover from that with acceptable loss, do nothing. I think the hard part is get people to do the math properly, e.g. what if you have to do recovery two weeks in a row, what is the likelihood of that happening...

@buherator @mrclark

I agree that your risk assessment decides which measures to take. True! And I'm always willing to discuss the risk.

But what "triggers" me is the "killer argument" that we aren't a bank. The last decade has shown that you don't have to be a bank to get financially motivated attackers to pwn you.

@Newk @mrclark I think you should not attack the problem from the angle of who is being targeted: it's pretty easy to see it's everyone. IME you can get to an actual victim with one handshake, maybe two if you don't work in infosec.

It's more important to make people realize that they have shit to loose: enumerate critical assets, create estimations what damage can be done (which is what banks do as part of their compliance process). Many businesses (manufacturing is a typical example) don't realize how much they rely on IT these days.

@buherator @mrclark