True Cost of Data Breaches

2 min read

The Cisco 2017 Annual Cybersecurity Report provides insights based on threat intelligence gathered by Cisco's security experts, combined with input from nearly 3,000 Chief Security Officers (CSOs), and other security operations leaders from businesses in 13 countries. 
 
Here are some takeaways:

• Data breaches have repercussions: More than 50 percent of organizations faced public scrutiny after a security breach. Operations and finance systems were the most affected, followed by brand reputation and customer retention.
  Lesson: Is sunlight the best disinfectant?
• Repercussions are expen$ive: For organizations that suffered a breach, the effect was substantial: 22% of breached organizations lost customers – 40% of them lost more than a fifth of their customer base and 29% lost revenue, with 38% of that group losing more than a fifth of their revenue. In addition, 23% of breached organizations lost business opportunities, with 42% of them losing more than a fifth of such opportunities.
  Lesson: There's a bad moon rising.
• Complexity and skill shortage drive risk: CSOs cite budget constraints, poor compatibility of systems, and a lack of trained talent as the biggest barriers to advancing their security postures. Security leaders also reveal that their security departments are increasingly complex environments with nearly two-thirds of organizations using six or more security products – some with even more than 50 – increasing the potential for security effectiveness gaps and mistakes.
  Lesson: Calculate asset risk to prioritize spending; co-sourcing can help.
• It’s the basics: Criminals are leveraging "classic" attack mechanisms such as adware and email spam in an effort to easily exploit the gaps that such complexity can create. Old-fashioned adware software that downloads advertising without user permission continues to prove successful, infecting 75% of organizations polled.
  Lesson: Security laggards, beware. Here are "some stories that never happened" from "files that do not exist".
• Spam works: Spam is now at a level not seen since 2010, and accounts for nearly two-thirds of all email – with 8-10% of it being outright malicious. Global spam volume is rising, often spread by large and thriving botnets.
  Lesson: Spam is easy and effective, so a mix of technology and awareness is needed.
• Data is everywhere; not much actionable intelligence: Just 56% of security alerts are investigated and less than half of legitimate alerts are actually remediated. Defenders, while confident in their tools, are undermined by complexity and manpower challenges. Criminals are exploiting the inability of organizations to handle all important security matters in a timely fashion.
  Lesson: Look for ease of use; get access to expertise via co-sourcing.

What can/should you do?

1. Improve threat defense technologies and processes after attacks by separating IT and security functions 
2. Increase security awareness training for employees 
3. Implement risk mitigation techniques