Security Budgets Going Up, Thanks To Mega-Breaches

Mega-breaches like those at Target and Sony are good for one thing: they help security departments get greater buy-in and bigger budgets from the powers that be. In the wake of the Target breach, 61 percent of organizations increased their security budgets by an average of 34 percent in 2014, according to a study released today, conducted by the Ponemon Institute on behalf of Identity Finder, LLC.

Nevertheless, only 67 percent of respondents said that their organizations gave them sufficient budget to defend against data breaches, even after the Target incident -- which, respondents say upped their upper management's concern about breaches from a 5.7 to a 7.8 on a scale of 1 to 10.

That said, most respondents agreed that they did have adequate tools and personnel to minimize (72%), quickly detect (69%), prevent (65%), and determine the root cause of (55%) data breaches.

Where is the extra money going? The report does not make it clear how much is being invested in new personnel. As for technology spending, the lion's share is going to endpoint security, intrusion detection systems, and security incident and event management (SIEM) systems.

In other words, it's mostly being used on tools that will help detect attacks -- which is important, since 46 percent of survey respondents said they discovered breaches "by accident" and 33 percent said it took them over a year to do so.

Organizations also reported that they'd made operational changes to enhance breach security. Half said they'd begun new security training and awareness activities, and 56 percent established incident response teams.

"Businesses are clearly spending money to prevent cyberattacks, but data breaches still occur. There must be a balance between blocking threats and reducing the footprint of vulnerable, sensitive data," said Todd Feinman, CEO of Identity Finder. "JP Morgan Chase spent over $250 million on cyber security last year, but still suffered from a significant data breach.  The recent Sony cyberattack where millions of instances of Social Security numbers were found within hundreds of files is an unfortunate example of the damage that can occur when an attack gets through and organizations don't properly store and classify sensitive information and don't remove outdated or redundant data completely."

Budgets will probably get another bump this year, now that company executives have Sony, Home Depot, and JP Morgan Chase haunting their dreams. 

To download "2014: Year of the Mega Breach," click here.