Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/11/2020
06:30 PM
50%
50%

Want to Avoid an Extreme Cyberloss? Focus on the Basics

New analysis of attacks and breaches -- to the tune of more than $20 million in damages and losses of at least 20 million records -- underscores the importance of planning for these events.

Companies that want to avoid the most extreme cybersecurity-related losses should use multifactor authentication, monitor for covert channels indicating a backdoor, patch regularly, and use automated test to detect misconfigurations — in other words, the basics, according to a new analysis of the most damaging breaches of the past five years.

The analysis — conducted by the Cyentia Institute, a data science firm, and based on a dataset from insurance-data firm Advisen — found the most expensive cyber incidents and breaches caused a median loss of $47 million. However, that loss grew quickly for companies that bungled their response to the incident, with the average firm suffering $109 million in damages if they responded slowly, compared with $39 million for all other incidents in the extreme-loss data set.

Related Content:

'Act of War' Clause Could Nix Cyber Insurance Payouts

The Changing Face of Threat Intelligence

New on The Edge: 9 New Tactics to Spread Security Awareness

The data underscores the importance that companies be prepared, says Wade Baker, a partner and co-founder at Cyentia and an associate professor of Integrated Security at Virginia Tech. 

"If we saw evidence that the organization responded poorly — which could mean they bungled it, they were constantly changing their story, or there was a lot of focus on the incompetence of the response — then we saw a pretty big difference [in losses]," he says. "It is a lesson for organizations on the importance of planning and preparing for these events. They are rare, but you make things a lot worse for yourself if you are not ready to respond to them."

The analysis identified a total of 103 incidents that met the thresholds and cost organizations more than $18 billion in total. The data scientists also combed through public information for information about the attack methods used in each cyberattack or breaches, finding the incidents were often caused by a failure to ensure that employees were following basic security precautions. Attackers used some sort of credential attack in 46 incidents, costing $10 billion; a backdoor in 31 incidents, accounting for $9 billion; and exploited a vulnerability in 22 incidents, costing $8 billion, according to the analysis.

The analysis suggests that preventing credential attacks using two-factor authentication, searching for backdoors using monitoring, and preventing application and vulnerability exploitation using an intrusion prevention system or web application firewall could pay off.

"If you are trying to prevent these mega incidents, these are the things that are most associated with those losses," Baker says. "I don't know why an organization would not be using two-factor authentication, but if they are not, I hope this convinces them that it's wise."

Overall, Cyentia found that 8% of all breaches exceeded the $20 million threshold for damages, and the top 5 incidents each exceeded $1 billion in damages. Among those large black-swan incidents are Facebook's $5 billion fine levied by the Federal Trade Commission for the Cambridge Analytica scandal, $2.0 billion in fines and clean-up costs for Equifax, and $1.3 billion in damages from NotPetya suffered by pharmaceutical firm Merck.

While attacks by nation-state actors only accounted for 20 of the 103 incidents, those cyberattacks were among the most expensive, accounting for 43% of the damages, Cyentia found.

"A lot of that is NotPetya, but we normally see a lot more cybercriminals groups," Baker says. "Just to see that level of damages in these really large events where these state-affiliated actors played a prominent role is interesting."

While the exact nature of the damages caused by cyberattacks could often not be determined, 29 of the 103 firms encountered response costs, 22 firms cited productivity or revenue loss, and 19 firms cited fines and judgments. Yet, the last factor is actually the least expensive cost per incident. While productivity and revenue loss accounted for a median loss of $68 million, fines and judgments as a category only accounted for $21 million.

The analysis not only holds strategies for companies, but suggests that the cyber-insurance market can adjust to the potential losses from cyberattacks and breaches targeting their policyholders. While several insurance firms have used "act of war" clauses to attempt to avoid paying out — currently the subject of a handful of lawsuits — such large events are not necessarily that common.

The median cost for companies fell just short of $200,000, according to the analysis.

"The potential impact of these events should be a part of any board-level discussion about cyber-risk," said Jack Freund, head of methodology at VisibleRisk, which sponsored the report, in the analysis's conclusion. "They need to know what a significant, adverse cyber event would look like for their organization. Only then can they truly understand what is required to protect their organization in a holistic way."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-23727
PUBLISHED: 2020-12-03
There is a local denial of service vulnerability in the Antiy Zhijia Terminal Defense System 5.0.2.10121559 and an attacker can cause a computer crash (BSOD).
CVE-2020-28175
PUBLISHED: 2020-12-03
There is a local privilege escalation vulnerability in Alfredo Milani Comparetti SpeedFan 4.52. Attackers can use constructed programs to increase user privileges
CVE-2020-13524
PUBLISHED: 2020-12-03
An out-of-bounds memory corruption vulnerability exists in the way Pixar OpenUSD 20.05 uses SPECS data from binary USD files. A specially crafted malformed file can trigger an out-of-bounds memory access and modification which results in memory corruption. To trigger this vulnerability, the victim n...
CVE-2020-13525
PUBLISHED: 2020-12-03
The sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTables_Ajax is vulnerable to SQL injection in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2020-23726
PUBLISHED: 2020-12-03
There is a local denial of service vulnerability in Wise Care 365 5.5.4, attackers can cause computer crash (BSOD).