What Moody’s and Standard & Poor’s are to credit ratings of companies, companies such as  FICO and Bitsight are becoming to cyber risk ratings for companies. Businesses have relied on credit ratings to determine investment risk levels and now companies are relying on rating companies to have a standard bench mark of cyber risk.  This growth industry of raters includes a number of providers and their customers use their services in a variety of ways.

Uses of Cybersecurity Scores

Insurance companies often use cybersecurity scores to help assign risk level for cyber insurance. Potential impact: Cost for cyber insurance will likely be higher for small businesses with gaps in their cybersecurity than for companies that have strong measures in place.

Businesses use scores to rate their third party providers during selection process. Potential impact: Suppliers may lose bids not on cost or service commitments, but rather on weak cybersecurity.

Businesses use scores to monitor their third party providers’ security risk level and potential impact to them. Potential impact: Large businesses may demand stronger cybersecurity measures from its suppliers and terminate agreements with low scored providers.

Businesses use scores to monitor their competitors’ cybersecurity level. Potential impact: Businesses may find ways to leverage a competitive advantage of their strong cybersecurity v their competitors’ weaker measures.

Companies use their own score to communicate their risk level to the board of directors. Potential impact: This may provide support for cybersecurity management to get the support they need due to increased board awareness.

The Data

Data comprising the cybersecurity score is gathered from a variety of publicly accessible information sources, including:

• Hackers’ forums and data available on the Dark Web
• Use of multi-factor authentication by a company
• Known vulnerabilities to a company’s network
• Open ports to a company’s network
• Patching practices

The risk raters also analyzing data that may flow into or out of a network to determine volume of malware, spam, or viruses that may be associated with a company’s network. The raters couple the data collected and analyzed with their proprietary predictive modeling. In some services, the data is monitoring continuously and a rating may quickly change to reflect any fluctuations. For example, if stolen data suddenly appears for sale on the Dark Web, the rating of the impacted company may be quickly decreased.

What You Can Do

If your business uses third party providers, you should think about investigating the services of scoring companies. If you are a supplier to a large company, you should consider talking to your client about how they are using cybersecurity scores for their vendors such as you. Cybersecurity is no longer a private matter within your own company. Future business deals and contracts may be won or lost on cyber security effectiveness, not just price or service levels.

The automotive industry’s cyber threat information sharing organization, Auto-ISAC, recently announced its best practices for cybersecurity measures for automobiles. The best practices are intended for all manufacturers and suppliers in the automotive industry, regardless of size. The organization states they built in flexibility for implementation by a range of companies.

Auto-ISAC is a member of the National Council of Information Sharing and Analysis Centers (ISACs). ISACs were created for various critical infrastructure industries after a presidential directive in 1998. The directive asked key critical infrastructure sectors to establish organizations that would share information about threats and vulnerabilities within their specific industry. Auto-ISAC is owned and operated by automotive manufacturers and suppliers.

The Auto-ISAC’s best practices are categorized by functions:

• Governance
• Risk assessment and management
• Security by design
• Threat detection and protection
• Incident response
• Awareness and training
• Collaboration and engagement with appropriate third parties

One lesson learned from the risk assessment and management category is the acknowledgement that cybersecurity needs to be part of the supply chain. The best practices recommend including the supply chain in risk assessments as well as developing a process to confirm compliance by critical suppliers to verify security requirements, guidelines, and training. A manufacturer can’t ensure final security without including all key suppliers.

Another lesson that can be learned from the automotive industry is its recognition that cybersecurity in the industry is about safety, not a competitive advantage. The best practices call out specifically the need for sharing of information with third parties such as Auto-ISAC, peers, researchers and government agencies. Collaboration is important among stakeholders to defend against cyber-attacks.

Billington Cybersecurity, a media company that produces a variety of events on cybersecurity, hosted a conference last week for the automotive industry. The Cyber Wire covered the conference in detail and noted that the large manufacturers are taking collaboration and sharing seriously.

The conference was attended by the Department of Transportation, auto manufacturers and suppliers. Participants seem to be highly interested in how other critical industries such as aerospace and defense are handling cybersecurity. A further lesson learned for small businesses is that increasingly, industries realize cyber-attacks need to be discussed among industry players and best practices shared.

Small businesses have an opportunity in many of their industries to be part of cybersecurity conversations and industry cybersecurity initiatives. Small businesses have as much to lose in cyber-attacks as do large businesses. Small business voices should be expressed to ensure their needs are represented.