Analytics
8/2/2011
10:31 AM
50%
50%

Study: Cybercrime Becoming More Costly, More Frequent For Enterprises

In survey of 50 companies, Ponemon finds average annual cost of cybercrime is $5.9 million

Cybercrime is not only becoming more frequent -- it's becoming more expensive for the victims, according to a study published today.

In its Second Annual Cost of Cybercrime study, the Ponemon Institute surveyed 50 large companies to determine the losses and expenditures caused by cybercrime. The study, sponsored by security information and event management company HP ArcSight, indicates that the cost of cybercrime has risen 56 percent since last year's report.

"We found that the median annualized cost of cybercrime for 50 organizations in our study is $5.9 million per year, with a range of $1.5 million to $36.5 million each year per company," the study says.

Some of the other findings:

>> Cybercrime cost varies by organizational size. The study results reveal a positive relationship between organizational size (as measured by enterprise seats) and annualized cost. However, smaller organizations incur a significantly higher per capita cost than larger-sized organizations ($1,088 vs. $284).

>> The companies participating in the study experienced 72 successful attacks per week -- or more than 1.4 successful attacks per organization. This figure has increased 44 percent over last year, Ponemon says.

>> The most costly cybercrimes are those caused by malicious code, denial-of-service, stolen or hijacked devices, and malicious insiders, according to the study. These account for more than 90 percent of all cybercrime costs per organization on an annual basis.

>> Cyberattacks can get costly if not resolved quickly, the study says. Results show a positive relationship between the time to contain an attack and organizational cost. The average time to resolve a cyberattack is 18 days, with an average cost of $415,748 over this 18-day period. This represents a 67 percent increase from last year’s estimated average cost of $247,744, which was compiled for a 14-day period.

>> Results show that malicious insider attacks can take more than 45 days on average to contain, Ponemon says. Information theft continues to represent the highest external cost, followed by the costs associated with business disruption. Information theft accounts for 40 percent of total external costs (down 2 percent from 2010). Costs associated with disruption to business or lost productivity account for 28 percent of external costs (up 6 percent from 2010).

>> Recovery and detection are the most costly internal activities associated with cybercrime, according to the study. Recovery and detection account for 45 percent of the total internal activity cost, most of it spent on cash outlays and labor. Having an SIEM system can help, according to Ponemon. "We found a percentage cost difference between SIEM and non-SIEM companies of 24 percent," the study says. "Findings suggest companies using SIEM were better able to quickly detect and contain cyber crimes than those companies not using SIEM."

Have a comment on this story? Please click "Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1774
Published: 2015-04-28
The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write.

CVE-2015-1863
Published: 2015-04-28
Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.

CVE-2015-3340
Published: 2015-04-28
Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.

CVE-2014-6090
Published: 2015-04-27
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCommands, and (3) IEGEditorCommands servlets in IBM Curam Social Program Management (SPM) 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix...

CVE-2014-6092
Published: 2015-04-27
IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to cause...

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.