The US government's assessment of the risk of cyber attacks by Russian hackers is getting worse as more attackers are detected daily and as they become more sophisticated. The US is now warning American businesses to adopt updated cyber security measures immediately.

The recent warning comes from an official in President Joe Biden's office and calls for companies to update their defenses, adding that President Biden expects "American businesses to act prudently." The speed at which new security measures can be implemented or an attack detected will depend on the size of a company. For example, large organizations will need a few months or longer for a full implementation, but smaller firms could implement tougher security controls in a matter of weeks — still faster than many other IT projects.

Even though cyber security is costly, it's necessary to consider the following: the probability of being hacked, the potential damage incurred (including loss of data, financial losses, legal actions, etc.) and the cost to recover from an attack. With these three figures in mind, even if a company has $100 million in revenue a year and spends $1 million on two-factor authentication for everything its employees access inside their network — assuming a 1% chance of getting hacked each month — such security measures can still be justified by the risk.

In case the attack leads to a loss of data or financial damages, then the time it takes to recover these losses would be another aspect to consider. The costs involved in such efforts can only be estimated considering the possible scenarios and losses that have been incurred. Before taking any actions, each company must first assess their risk in numbers and then decide how much it is willing to spend on improving cyber security measures.

It should also be noted that even well-established organizations like Google and Microsoft could get hacked because they don't consistently exercise enough precautions (Microsoft recently suffered a major hacking incident by the Lapsus$ hacking group).

Businesses should update their cyber security immediately because it's an urgent matter. They shouldn't leave any room for hackers to steal sensitive customer data or launch DDoS attacks on the organizations' websites, which can automatically be protected by content delivery networks (CDNs).

Ultimately, all companies should implement two-factor authentication and employee security training as basic preventive measures because they offer quick returns on investment. If a company has one system of data that gets hacked, then two-factor authentication can usually impede additional data compromise. Also, training all employees to follow reasonable security protocols can prevent social engineering hacks.