Enterprising Developments

Cost of Cyber Crime Keeps Soaring: How Worried Should We Be?

Joe McKendrick
Insurance Experts' Forum, February 9, 2011

A few months back, the Ponemon Institute released calculations of the cost of enterprise security breaches, and they aren't cheap.

Researchers determined that the median annualized cost of cyber crime of 45 organizations studied is $3.8 million per year. The range was $1 million to $52 million per year per company.

The report, initially released last summer and made available by its sponsor, ArcSight (recently acquired by HP), is worth resurfacing because it actually puts a number value on the financial costs of information security breaches. Often, companies are reluctant to put out too much money for information security efforts. Ponemon reports that cyber attacks have become common occurrences.

“The companies in our study experienced 50 successful attacks per week and more than one successful attack per company per week,” the report states.

The most costly cyber crimes are those caused by Web attacks, malicious code and malicious insiders, which account for more than 90% of all cyber crime costs per organization on an annual basis.

Even more eye opening is the length of time it takes to deal with security incidents. Speed seems to matter. A great deal of the costs appear to be related to how quickly companies can respond to and resolve attacks. On average, Ponemon found, companies expend $247,757 every 14 days or $17,696 per day per attack. The average amount of time to resolve a malicious code attack is 39 days; 30 days to deal with malicious insiders, and 19 days to resolve a Web attack.

But here's the rub: Whether it's within a month or less, these incidents are only resolved if managers and administrators are aware if the breach is taking place. There may be many instances where breaches could go on for months and even years with no knowledge of what's going on. What can help spot discrepancies? Auditing, for one—while it won't prevent breaches, it may help stop ongoing data leaks. In my own survey work in this area, there is still precious little auditing taking place.

Joe McKendrick is an author, consultant, blogger and frequent INN contributor specializing in information technology.

Readers are encouraged to respond to Joe using the “Add Your Comments” box below. He can also be reached at joe@mckendrickresearch.com.

This blog was exclusively written for Insurance Networking News. It may not be reposted or reused without permission from Insurance Networking News.

The opinions of bloggers on www.insurancenetworking.com do not necessarily reflect those of Insurance Networking News.

Comments (0)

Be the first to comment on this post using the section below.

Add Your Comments...

Already Registered?

If you have already registered to Insurance Networking News, please use the form below to login. When completed you will immeditely be directed to post a comment.

Forgot your password?

Not Registered?

You must be registered to post a comment. Click here to register.

Blog Archive

For Halloween: The Tricks to Get Innovation Treats

There are specific actions that can help prepare a corporate environment for magic.

Is the Long March to IFRS Convergence Over?

Once a given, the adoption of a single set of accounting standards for the insurance industry is on hold.

So You Plan to Buy a Core System … Now What?

There are many questions for carriers to consider even before the implementation process begins.

What It Takes to Have a Tech-Savvy Workplace

The tools and technologies to build the next workplace are available, but not common yet in corporate settings.

Avoiding the Bermuda Triangle of Data

Handled poorly, questions around data ownership, data quality and data security can sidetrack big data conversations and alienate business stakeholders.

A Prototype of the Successful Innovation Leader

Celent research reveals the prototype for the successful senior innovation leader.