The costs associated with security breaches are going up, jumping 29 percent in recent years to more than $4 million per incident, according to Ponemon’s annual bench marking report. In addition, when it comes to the impacts of breaches – such as cost per record lost – Ponemon says the gap is widening between organizations that are unprepared and those that have added policies and processes like incident response plans, encryption, and employee training.
To calculate the average cost of a data breach, Ponemon collects both the direct and indirect expenses as well as opportunity costs incurred by the organization as follows:
- Direct cost – the direct expense outlay to accomplish a given activity, such as engaging forensic experts, outsourcing hotline support and providing free credit monitoring subscriptions and discounts for future products and services.
- Indirect cost – the amount of time, effort and other organizational resources spent in the aftermath of a breach, such as in-house investigations and communications. This category also includes the extrapolated value of customer loss resulting from turnover.
- Opportunity cost – the cost of lost business opportunities resulting from negative reputation effects after the breach has been reported to victims and publicly revealed to the media.
A recent report from Deloitte says the costs of a cybersecurity breach could be higher than most data shows as the costs can rack up for many years after the initial incident. The firm identified 14 cyberattack impact factors, including seven it claims are hiding beneath the surface and account for 95 percent of the financial impact. (see chart below).
Small business owners need to take caution as well. One may think; "I'm too small to be a target". Security by obscurity is not a good policy. One may think: "I've got a firewall and a good IT company". Are you willing to bet your business on that? Cyber Security is a specialized field and many "generalist" IT and MSP organizations today simply do not have the expertise needed to properly and adequately protect your hard earned investment and customers. There are numerous cost-effective, methods, practices, and managed services that will significantly reduce your exposure and augment what your IT company is already doing.
Contact us at Cloud 9 Advisers to learn about better ways to protect your business. Through our Consulting & Buying Program, our consulting services are free to you. We are provider-neutral, independent, and unbiased consultants of technology, telecom, cloud, and security services.
