One of the most cited statistics related to cyberattacks is the average cost of a data breach as calculated by The Ponemon Institute with support from IBM. The 2018 Cost of a Data Breach report, which has become an industry benchmark, also tracks the number of days it takes to identify a breach and the number of days to contain a breach among other data points.
As with past reports, this year’s average cost of a breach gets the most attention. (By the way, the average total breach cost, the average cost per record, and the average number of records lost are all up again this year on a global basis.) And, as usual, not everyone agrees with the conclusion or methodology.
However, one statistic within the report reveals the scope of the problem at hand. Another gives a glimmer of hope for those organizations that have taken the leap of faith to deploy the latest technologies and techniques that rely more on automation and less on hands on keyboards.
Ponemon reports that nearly half (48 percent) of the attacks included in the 2018 research were criminal or malicious in nature. That’s a staggering number, especially when you take into considering other findings from Ponemon that indicate criminal cyberattacks take the most amount of time to detect and remediate – a global average of 302 days – and are also the costliest. The longer it takes to stop an attack and fix the root cause, the higher the cost – as much as $1 million USD on average if the containment takes longer than 30 days.
It’s not particularly surprising that the average cost and time associated to detect and address attacks are increasing given the number and scope of data breaches. What is encouraging, though, is a first-time statistic in the Ponemon/IBM study: the impact of automated security solutions on breach costs.
Ponemon defines these new technologies and tools as “security technologies that augment or replace human intervention in the identification and containment of cyber exploits or breaches.” The 15 percent of responding companies that used security automation realized a total breach cost nearly $1 million USD lower that the global average ($2.88 million USD vs $3.86 million USD). The 51 percent who had no automation or plans for adding automation saw average breach costs of $4.43 million USD, a net higher cost of $1.55 million USD.
The message from these findings is clear: companies that still rely on manual processes – security tools that require frequent tuning or manual CVE patching, for example – fare worse if they are breached. One year of data does not make a trend, but it’s reasonable to believe the number of breaches will decline, too, as more organizations deploy automated tools that address the leading cause of cyberattacks – known, but unpatched flaws in applications.
About the author: James E. Lee is the Executive Vice President and Global CMO at Waratek. He was theformer CMO at data pioneer ChoicePoint and an expert in data privacy and security, having served nine years on the Board of the San Diego-based Identity Theft Resource Center including three years as Chair.
Source: infosec island