REPUTATION MORE VALUABLE THAN CASH (ASK SONY)

The recent attack (it seems by Anonymous) on SONY which compromised the personal details of almost 100m of their gaming customers has caused massive damage to the SONY brand.   According to Interbrand in 2009 SONY’s brand value was $12bn.   You can safely assume that it will have taken a hit in the order of billions of dollars.  ( This excludes any legal action and the resultant loss.) 

The same could be said of Epsilon and RSA who like SONY did not have a major financial breach but their good names have been severely compromised.   The loss to brand value as well as enterprise value could be massive due to the loss of future business.    (There is a report circulating citing research done on RSA’s customers of whom more than half stated that they would not be renewing their contracts. )    If not obvious before,  then now,  executives charged with the stewardship of large valuable corporations must realize how fragile that value is when faced with the multitude of challenges;   be they natural (tsunamis/earthquakes) or man-made (criminal / terrorism/fraud) or just good old competition.  

In respect of cybercrimes such as phishing and pharming attacks which can lead to either direct financial loss (draining of bank accounts/ theft of credit card details) or reputational damage (per the above) I contend that the latter constitutes a far greater threat than the former.  ( There are those who would argue that the  value of an email address exceeds that of a credit card number in the parallel world of the cybercriminal.)   In respect of individuals this would be in the form of ID theft where personal credentials are used to commit fraud thereby damaging (perhaps irreparably) that persons reputation.     We have seen from the above examples of just how,  a corporation's reputation can be impacted.   A person or a corporation would much rather that money was stolen than their reputation was damaged;   as the latter is very difficult to rebuild and, if so, invariably takes a long time. 

The need for strong authentication in situations where today simple ‘identification’ is used (such as applications using - user name and password / Single Sign On / OpenID) has become an urgent imperative.   Even then those authentication solutions need to be affordable, usable and effective.    Multi-factor solutions such as OOB tokens, OTP keys and browser-based javascript fingerprinting have relied on the browser, user acumen and ‘security by obscurity’ to function.

I believe we will see a steady trend of individuals and corporations demanding better security in the form of two factor authentication  (as a minimum) from their business partners / suppliers and customers.    We have seen many large corporations fall from grace very quickly for many reasons (Arthur Andersen / Enron / WorldCom / Lehman Brothers / Bear Sterns ).  

No corporation can afford to crash or be severely damaged, because they were hacked,  because they did not take their online security seriously.