Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


06:30 PM

Want to Avoid an Extreme Cyberloss? Focus on the Basics

New analysis of attacks and breaches -- to the tune of more than $20 million in damages and losses of at least 20 million records -- underscores the importance of planning for these events.

Companies that want to avoid the most extreme cybersecurity-related losses should use multifactor authentication, monitor for covert channels indicating a backdoor, patch regularly, and use automated test to detect misconfigurations — in other words, the basics, according to a new analysis of the most damaging breaches of the past five years.

The analysis — conducted by the Cyentia Institute, a data science firm, and based on a dataset from insurance-data firm Advisen — found the most expensive cyber incidents and breaches caused a median loss of $47 million. However, that loss grew quickly for companies that bungled their response to the incident, with the average firm suffering $109 million in damages if they responded slowly, compared with $39 million for all other incidents in the extreme-loss data set.

Related Content:

'Act of War' Clause Could Nix Cyber Insurance Payouts

The Changing Face of Threat Intelligence

New on The Edge: 9 New Tactics to Spread Security Awareness

The data underscores the importance that companies be prepared, says Wade Baker, a partner and co-founder at Cyentia and an associate professor of Integrated Security at Virginia Tech. 

"If we saw evidence that the organization responded poorly — which could mean they bungled it, they were constantly changing their story, or there was a lot of focus on the incompetence of the response — then we saw a pretty big difference [in losses]," he says. "It is a lesson for organizations on the importance of planning and preparing for these events. They are rare, but you make things a lot worse for yourself if you are not ready to respond to them."

The analysis identified a total of 103 incidents that met the thresholds and cost organizations more than $18 billion in total. The data scientists also combed through public information for information about the attack methods used in each cyberattack or breaches, finding the incidents were often caused by a failure to ensure that employees were following basic security precautions. Attackers used some sort of credential attack in 46 incidents, costing $10 billion; a backdoor in 31 incidents, accounting for $9 billion; and exploited a vulnerability in 22 incidents, costing $8 billion, according to the analysis.

The analysis suggests that preventing credential attacks using two-factor authentication, searching for backdoors using monitoring, and preventing application and vulnerability exploitation using an intrusion prevention system or web application firewall could pay off.

"If you are trying to prevent these mega incidents, these are the things that are most associated with those losses," Baker says. "I don't know why an organization would not be using two-factor authentication, but if they are not, I hope this convinces them that it's wise."

Overall, Cyentia found that 8% of all breaches exceeded the $20 million threshold for damages, and the top 5 incidents each exceeded $1 billion in damages. Among those large black-swan incidents are Facebook's $5 billion fine levied by the Federal Trade Commission for the Cambridge Analytica scandal, $2.0 billion in fines and clean-up costs for Equifax, and $1.3 billion in damages from NotPetya suffered by pharmaceutical firm Merck.

While attacks by nation-state actors only accounted for 20 of the 103 incidents, those cyberattacks were among the most expensive, accounting for 43% of the damages, Cyentia found.

"A lot of that is NotPetya, but we normally see a lot more cybercriminals groups," Baker says. "Just to see that level of damages in these really large events where these state-affiliated actors played a prominent role is interesting."

While the exact nature of the damages caused by cyberattacks could often not be determined, 29 of the 103 firms encountered response costs, 22 firms cited productivity or revenue loss, and 19 firms cited fines and judgments. Yet, the last factor is actually the least expensive cost per incident. While productivity and revenue loss accounted for a median loss of $68 million, fines and judgments as a category only accounted for $21 million.

The analysis not only holds strategies for companies, but suggests that the cyber-insurance market can adjust to the potential losses from cyberattacks and breaches targeting their policyholders. While several insurance firms have used "act of war" clauses to attempt to avoid paying out — currently the subject of a handful of lawsuits — such large events are not necessarily that common.

The median cost for companies fell just short of $200,000, according to the analysis.

"The potential impact of these events should be a part of any board-level discussion about cyber-risk," said Jack Freund, head of methodology at VisibleRisk, which sponsored the report, in the analysis's conclusion. "They need to know what a significant, adverse cyber event would look like for their organization. Only then can they truly understand what is required to protect their organization in a holistic way."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-22
Improper authorization in handler for custom URL scheme vulnerability in ????????? (asken diet) for Android versions from v.3.0.0 to v.4.2.x allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App.
PUBLISHED: 2021-06-22
Cross-site scripting vulnerability in Welcart e-Commerce versions prior to 2.2.4 allows remote attackers to inject arbitrary script or HTML via unspecified vectors.
PUBLISHED: 2021-06-22
Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier, and Delivery slip number mail plugin (3.0 series) 1.0.8 and earlier) allows remote attackers to ...
PUBLISHED: 2021-06-22
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors.
PUBLISHED: 2021-06-22
Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via unspecified vectors.