Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


06:30 PM

Want to Avoid an Extreme Cyberloss? Focus on the Basics

New analysis of attacks and breaches -- to the tune of more than $20 million in damages and losses of at least 20 million records -- underscores the importance of planning for these events.

Companies that want to avoid the most extreme cybersecurity-related losses should use multifactor authentication, monitor for covert channels indicating a backdoor, patch regularly, and use automated test to detect misconfigurations — in other words, the basics, according to a new analysis of the most damaging breaches of the past five years.

The analysis — conducted by the Cyentia Institute, a data science firm, and based on a dataset from insurance-data firm Advisen — found the most expensive cyber incidents and breaches caused a median loss of $47 million. However, that loss grew quickly for companies that bungled their response to the incident, with the average firm suffering $109 million in damages if they responded slowly, compared with $39 million for all other incidents in the extreme-loss data set.

Related Content:

'Act of War' Clause Could Nix Cyber Insurance Payouts

The Changing Face of Threat Intelligence

New on The Edge: 9 New Tactics to Spread Security Awareness

The data underscores the importance that companies be prepared, says Wade Baker, a partner and co-founder at Cyentia and an associate professor of Integrated Security at Virginia Tech. 

"If we saw evidence that the organization responded poorly — which could mean they bungled it, they were constantly changing their story, or there was a lot of focus on the incompetence of the response — then we saw a pretty big difference [in losses]," he says. "It is a lesson for organizations on the importance of planning and preparing for these events. They are rare, but you make things a lot worse for yourself if you are not ready to respond to them."

The analysis identified a total of 103 incidents that met the thresholds and cost organizations more than $18 billion in total. The data scientists also combed through public information for information about the attack methods used in each cyberattack or breaches, finding the incidents were often caused by a failure to ensure that employees were following basic security precautions. Attackers used some sort of credential attack in 46 incidents, costing $10 billion; a backdoor in 31 incidents, accounting for $9 billion; and exploited a vulnerability in 22 incidents, costing $8 billion, according to the analysis.

The analysis suggests that preventing credential attacks using two-factor authentication, searching for backdoors using monitoring, and preventing application and vulnerability exploitation using an intrusion prevention system or web application firewall could pay off.

"If you are trying to prevent these mega incidents, these are the things that are most associated with those losses," Baker says. "I don't know why an organization would not be using two-factor authentication, but if they are not, I hope this convinces them that it's wise."

Overall, Cyentia found that 8% of all breaches exceeded the $20 million threshold for damages, and the top 5 incidents each exceeded $1 billion in damages. Among those large black-swan incidents are Facebook's $5 billion fine levied by the Federal Trade Commission for the Cambridge Analytica scandal, $2.0 billion in fines and clean-up costs for Equifax, and $1.3 billion in damages from NotPetya suffered by pharmaceutical firm Merck.

While attacks by nation-state actors only accounted for 20 of the 103 incidents, those cyberattacks were among the most expensive, accounting for 43% of the damages, Cyentia found.

"A lot of that is NotPetya, but we normally see a lot more cybercriminals groups," Baker says. "Just to see that level of damages in these really large events where these state-affiliated actors played a prominent role is interesting."

While the exact nature of the damages caused by cyberattacks could often not be determined, 29 of the 103 firms encountered response costs, 22 firms cited productivity or revenue loss, and 19 firms cited fines and judgments. Yet, the last factor is actually the least expensive cost per incident. While productivity and revenue loss accounted for a median loss of $68 million, fines and judgments as a category only accounted for $21 million.

The analysis not only holds strategies for companies, but suggests that the cyber-insurance market can adjust to the potential losses from cyberattacks and breaches targeting their policyholders. While several insurance firms have used "act of war" clauses to attempt to avoid paying out — currently the subject of a handful of lawsuits — such large events are not necessarily that common.

The median cost for companies fell just short of $200,000, according to the analysis.

"The potential impact of these events should be a part of any board-level discussion about cyber-risk," said Jack Freund, head of methodology at VisibleRisk, which sponsored the report, in the analysis's conclusion. "They need to know what a significant, adverse cyber event would look like for their organization. Only then can they truly understand what is required to protect their organization in a holistic way."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-11-24
499ES EtherNet/IP (ENIP) Adaptor Source Code is vulnerable to a stack-based buffer overflow, which may allow an attacker to send a specially crafted packet that may result in a denial-of-service condition or code execution.
PUBLISHED: 2020-11-24
An ACL bypass flaw was found in pacemaker before 1.1.24-rc1 and 2.0.5-rc2. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went throu...
PUBLISHED: 2020-11-24
Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Affected Version(s):,,,
PUBLISHED: 2020-11-24
HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.
PUBLISHED: 2020-11-24
A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.