Cost of a Security Breach

There are many types of security breaches. Some attackers want your data. Some want your money. Some want your intellectual property. Others want chaos. Not matter what they want, a breach is going to cost you money. But how much money? IBM has a Cost of Data Breach Calculator.

Data records are stolen at a rate of 58/sec. And with an annual average cost of $3.6M per breach that works out to $141 per record. But what about other costs?

Yahoo lost $350M in their deal with Verizon because of a data breach.

In recent years, three high profile companies were put out of business from security breaches:

1. Code Spaces
2. Nirvanix
3. MyBizHomepage

And 60% of small businesses fail within 6 months of a security breach. The cost to recover are high and the damage to reputation can be too.

How common are security breaches?

Last year 43% of companies had a data breach.

While security breaches may be costly, so is preventing them. Worldwide spending on information security products and services will reach more than $114 billion in 2018, an increase of 12.4 percent from last year, according to the latest forecast from Gartner, Inc. In 2019, the market is forecast to grow 8.7 percent to $124 billion. See link for breakdown of spending by segment.

Here are the 30 cybersecurity stats that matter most according to Tech Beacon.
Some amazing stats from this survey are:

• 191 days: The average length of time it takes for organizations to identify a data breach 
• 66 days: The average time needed to fully contain a data breach in 2017 
• 77%: Proportion of respondents in a survey of 2,800 IT professionals who said their organizations do not have a formal cybersecurity incident response plan

My personal opinion, which is backed by the spending trends and the data breach trends, is that organizations broadly don't take security seriously enough and don't spend enough on security.

That said, money alone isn't the answer.

Everyday developers and office workers make 100s of decisions and many of them have security impacts. But you can't train yourself into a secure position. Instead, you have to develop a set of guard rails that largely make it impossible for users to make bad decisions.

And you have to realize that threats from the inside are just as big as those from the outside. This requires a two pronged approach to defense. You have to secure end points and networks from external attackers with proper security orchestration and automated response (SOAR) tools. But you also have to have adequate governance and compliance regimes in place to do basic things like encrypt data at rest and in transit and implement least privileged security models, automated provisioning with approval workflows, access certification and automated termination. Offsite backup and incident and disaster response plans and drills are also necessities as fail safes for when everything else fails. This defense in depth strategy is really the only path forward.