Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

6/15/2016
09:50 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Average Cost Of Data Breaches Rises Past $4 Million, Ponemon Says

Ponemon annual report shows benchmark index on the rise again, while Deloitte advises those tangible costs may be just the start to financial impact racked up by breached organizations.

When security executives design the slide decks for their board room presentation about the financial risks of data breaches, they'd better increase the numbers this year. In two separate studies out today by the Ponemon Institute and Deloitte Advisory, traditional data breach costs are on the rise and at the same time the hidden costs of data breaches are also proving to be far more expensive than experts initially anticipated.

The annual Ponemon Cost of Data Breach 2016 report established its yearly benchmark statistics once again, with evidence that breach costs are going up. Sponsored by IBM, the comprehensive study found that the average cost of breaches at organizations have jumped past $4 million per incident, a 29% increase since 2013 and 5% increase since last year. The study found that average dwell time for breaches stands at 201 days, with organizations requiring another 70 days to contain breaches once they'd been identified.

According to the study, when it comes to the impacts of breaches -- like cost per record lost -- the delta continues to widen between organizations that are unprepared and organizations that have instituted mitigating factors like incident response plans, encryption, and employee training. The average cost per record equaled about $158. Having an incident response plan and team in place reduced that figure drastically, by $16 per record. 

"That's huge," says Diana Kelly, executive security advisor for IBM. "It's basically a matter of either having your plan and running that playbook or at least calling someone in to help with response. The savings make sense because without that people start to do things after a breach that don't necessarily benefit the response effectiveness or efficiency and could hurt it."

Other measures that tangibly affected cost-per-record savings included extensive use of encryption, which reduced the cost by $13 per record, use of threat sharing, which lowered it by $9, and having a CISO appointed, which sent it down by $7.

Meanwhile, Deloitte Advisory services says the damages could actually be much higher than those outlined by Ponemon and present themselves many years after the breach. Deloitte's new report, "Beneath the surface of a cyberattack," showed that in addition to the well-known costs like breach notification, post-breach protection and technical investigations, hidden costs also present themselves -- in the way of insurance premium increases, increased cost to raise debt, and devaluation of trade name. Deloitte estimates that the known costs may actually only account for less than 5% of total business impact. 

“Many executives have difficulty gauging potential impact, partly because they are not typically privy to what other industry participants struggle with as they work to get their businesses back on their feet after a cyber incident," says Emily Mossburg, principal for Deloitte & Touche LLP, and resilient practice leader for Deloitte Advisory cyber risk services. "An accurate picture of cyberattack impact has been lacking, and therefore many companies are not developing the cyber risk postures that they need.”

In one composite model put together by Deloitte for the report, it showed that the cost to a healthcare company it worked with actually lost $1.6 billion due to a significant breach of patient records, with only 3.5% of those costs coming in the form of "above the surface" costs. The costs under the surface included lost contract revenue and premiums and lost customer relationships.

It's a stark warning to organizations that the effects of a breach ripple outward much farther than they initially calculated. 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PeterMerkulov
50%
50%
PeterMerkulov,
User Rank: Author
6/17/2016 | 7:51:13 AM
If You Think Security is Expensive...
"If you think security is expensive you should try the alternative" is a new take on an old saying, but the Ponemon report once again puts an eye-opening cost on the consequences of a security failure. Certainly no one is immune to a breach, but as the report points out, preparation and rapid, effective response goes a long way to mitigating the effects.
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-29040
PUBLISHED: 2021-05-16
The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused att...
CVE-2021-29041
PUBLISHED: 2021-05-16
Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by (1) enabling Time-based One-time password (TOTP) on behalf of the other user or (2) modifying the othe...
CVE-2021-29047
PUBLISHED: 2021-05-16
The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer.
CVE-2021-22668
PUBLISHED: 2021-05-16
Delta Industrial Automation CNCSoft ScreenEditor Versions 1.01.28 (with ScreenEditor Version 1.01.2) and prior are vulnerable to an out-of-bounds read while processing project files, which may allow an attacker to execute arbitrary code.
CVE-2021-29039
PUBLISHED: 2021-05-16
Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.