- [Instructor] Achieving our customer's expectations
is one of the four major goals
of an information security program.
Businesses need the trust of their customers
in order to remain viable.
One of the many negative consequences
of a breach of confidential customer data
is abnormal customer churn.
Customers will leave you
just for violating this sacred trust.
To be clear, this is a loss of customers
above and beyond the normal loss
that all businesses experience.
According to the 2019 Cost of Data Breach study
conducted by the Ponemon Institute,
the rate of abnormal churn for healthcare organizations
can be as high as 7%.
You can see the rest of the industries in this bar chart.
Trust is also a cultural phenomenon,
so you can expect higher abnormal churn
in France, Italy, and Japan.
But lots of countries have measurable amounts
of sensitivity.
So your customers are trusting you with their data.
Let's review what that means within the context
of the three goals of information security.
First, confidentiality means
you're protecting the information customers share with you,
such as their personal information,
or those of their customers.
Second, integrity means
that the information your customers share with you
will not become corrupt
before you make decisions based on it,
or when they access it again.
And availability means that
the products and services you sell
will be available whenever they're needed,
such as a bill payment portal or shipment tracking.
The failure of your information security program
can result in big losses for your customers.
Here's an example.
In September of 2017, the crypto disk wiper NotPetya
stormed across Europe,
knocking out the entire computer system of TNT Express.
There, the small package delivery company
that was recently acquired by the global giant, FedEx.
The outage caused at least $400 million
in direct damage to TNT.
And it caused even more damage to the supply chains
of thousands of other companies who couldn't send, receive,
or track their shipments for weeks.
By examining TNT's public financial statements
in the months following the attacks,
you can see revenue, shipments, and profit were all down.
Why?
Because customers were defecting to rivals, such as DHL,
which was not offline after NotPetya struck,
and has enjoyed more business and greater profitability
just by keeping their doors open when TNT could not.
Your company makes confidentiality, integrity,
and availability promises to your customers
in the contracts they sign with your organization.
Customers also count on your company
to obey the laws and regulations
related to information and cybersecurity.
For some companies,
knowing what you've promised to customers
is easy to determine
because you offer a standard contract to everyone.
Like a software company
or mobile phone provider that sells to consumers.
For other companies,
customer promises are negotiated on a deal-by-deal basis,
such as a business selling highly-customized services
to another company.
To keep customer promises about information security,
there are three specific activities
your program needs to practice.
First, perform an initial review of all customer contracts.
You might only have enough time to review the major ones.
Or you might only need to review the standard contracts
whenever they change.
Once you know what promises you're making,
incorporate these requirements into your daily operations.
Finally, give prompt notification
whenever you fail to meet these customer requirements.
This probably seems risky and dangerous to do,
and it may be, but it's even more risky
to not say anything if it happens.
If you violate your customer's trust,
eventually someone will find out.
And when they do,
you'll have a much tougher problem on your hands.