Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/11/2020
06:30 PM
50%
50%

Want to Avoid an Extreme Cyberloss? Focus on the Basics

New analysis of attacks and breaches -- to the tune of more than $20 million in damages and losses of at least 20 million records -- underscores the importance of planning for these events.

Companies that want to avoid the most extreme cybersecurity-related losses should use multifactor authentication, monitor for covert channels indicating a backdoor, patch regularly, and use automated test to detect misconfigurations — in other words, the basics, according to a new analysis of the most damaging breaches of the past five years.

The analysis — conducted by the Cyentia Institute, a data science firm, and based on a dataset from insurance-data firm Advisen — found the most expensive cyber incidents and breaches caused a median loss of $47 million. However, that loss grew quickly for companies that bungled their response to the incident, with the average firm suffering $109 million in damages if they responded slowly, compared with $39 million for all other incidents in the extreme-loss data set.

Related Content:

'Act of War' Clause Could Nix Cyber Insurance Payouts

The Changing Face of Threat Intelligence

New on The Edge: 9 New Tactics to Spread Security Awareness

The data underscores the importance that companies be prepared, says Wade Baker, a partner and co-founder at Cyentia and an associate professor of Integrated Security at Virginia Tech. 

"If we saw evidence that the organization responded poorly — which could mean they bungled it, they were constantly changing their story, or there was a lot of focus on the incompetence of the response — then we saw a pretty big difference [in losses]," he says. "It is a lesson for organizations on the importance of planning and preparing for these events. They are rare, but you make things a lot worse for yourself if you are not ready to respond to them."

The analysis identified a total of 103 incidents that met the thresholds and cost organizations more than $18 billion in total. The data scientists also combed through public information for information about the attack methods used in each cyberattack or breaches, finding the incidents were often caused by a failure to ensure that employees were following basic security precautions. Attackers used some sort of credential attack in 46 incidents, costing $10 billion; a backdoor in 31 incidents, accounting for $9 billion; and exploited a vulnerability in 22 incidents, costing $8 billion, according to the analysis.

The analysis suggests that preventing credential attacks using two-factor authentication, searching for backdoors using monitoring, and preventing application and vulnerability exploitation using an intrusion prevention system or web application firewall could pay off.

"If you are trying to prevent these mega incidents, these are the things that are most associated with those losses," Baker says. "I don't know why an organization would not be using two-factor authentication, but if they are not, I hope this convinces them that it's wise."

Overall, Cyentia found that 8% of all breaches exceeded the $20 million threshold for damages, and the top 5 incidents each exceeded $1 billion in damages. Among those large black-swan incidents are Facebook's $5 billion fine levied by the Federal Trade Commission for the Cambridge Analytica scandal, $2.0 billion in fines and clean-up costs for Equifax, and $1.3 billion in damages from NotPetya suffered by pharmaceutical firm Merck.

While attacks by nation-state actors only accounted for 20 of the 103 incidents, those cyberattacks were among the most expensive, accounting for 43% of the damages, Cyentia found.

"A lot of that is NotPetya, but we normally see a lot more cybercriminals groups," Baker says. "Just to see that level of damages in these really large events where these state-affiliated actors played a prominent role is interesting."

While the exact nature of the damages caused by cyberattacks could often not be determined, 29 of the 103 firms encountered response costs, 22 firms cited productivity or revenue loss, and 19 firms cited fines and judgments. Yet, the last factor is actually the least expensive cost per incident. While productivity and revenue loss accounted for a median loss of $68 million, fines and judgments as a category only accounted for $21 million.

The analysis not only holds strategies for companies, but suggests that the cyber-insurance market can adjust to the potential losses from cyberattacks and breaches targeting their policyholders. While several insurance firms have used "act of war" clauses to attempt to avoid paying out — currently the subject of a handful of lawsuits — such large events are not necessarily that common.

The median cost for companies fell just short of $200,000, according to the analysis.

"The potential impact of these events should be a part of any board-level discussion about cyber-risk," said Jack Freund, head of methodology at VisibleRisk, which sponsored the report, in the analysis's conclusion. "They need to know what a significant, adverse cyber event would look like for their organization. Only then can they truly understand what is required to protect their organization in a holistic way."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-25694
PUBLISHED: 2021-05-13
Teradici PCoIP Graphics Agent for Windows prior to 21.03 does not validate NVENC.dll. An attacker could replace the .dll and redirect pixels elsewhere.
CVE-2020-12967
PUBLISHED: 2021-05-13
The lack of nested page table protection in the AMD SEV/SEV-ES feature could potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to compromise the server hypervisor.
CVE-2021-26311
PUBLISHED: 2021-05-13
In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to compromise...
CVE-2021-22152
PUBLISHED: 2021-05-13
A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially to prevent any new user connections.
CVE-2021-22153
PUBLISHED: 2021-05-13
A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially cause the spreadsheet application to run commands on the victim’s local machine with t...