{"id":625,"date":"2021-11-27T13:59:58","date_gmt":"2021-11-27T13:59:58","guid":{"rendered":"https:\/\/www.tsfactory.com\/forums\/blogs\/?p=625"},"modified":"2021-11-27T14:19:42","modified_gmt":"2021-11-27T14:19:42","slug":"cost-of-cyber-attacks-vs-cost-of-cybersecurity-in-2021","status":"publish","type":"post","link":"https:\/\/www.tsfactory.com\/forums\/blogs\/cost-of-cyber-attacks-vs-cost-of-cybersecurity-in-2021\/","title":{"rendered":"Cost of Cyber Attacks vs. Cost of Cybersecurity in 2021"},"content":{"rendered":"

Cost of Cyber Attacks vs. Cost of Cybersecurity in 2021<\/b><\/p>\n

If you think cybersecurity is expensive, just wait to see what lack of cybersecurity costs. The costs of cyber attacks vs the costs of cybersecurity has been debated for years, however it is now clear which one is the clear winner. According to IBM and the Ponemon Institute\u2019s 2020 \u201c<\/span>Cost of a Data Breach<\/span><\/a>\u201d report, it was determined that the average total cost of cybersecurity breaches in the US, between August 2019 and April 2020, was $8,640,000.\u00a0<\/span><\/p>\n

Types of Attacks & Associated Costs<\/b><\/p>\n

The specific costs will depend on the sophistication of the attack and how well executed it was.<\/span><\/p>\n

For example, a <\/span>DDoS (distributed denial-of-service) attack<\/span><\/a> could knock systems offline for a few hours, creating a frustrated workforce and unhappy customers \u2013 but otherwise the cost would be comparatively low.<\/span><\/p>\n

By contrast, an attacker who infects an organisation\u2019s systems with <\/span>ransomware<\/span><\/a> could cripple them for days or even weeks. The cost of recovery, not to mention the ransom payment (if the organisation pays up) could result in losses in the millions.<\/span><\/p>\n

Malicious actors don\u2019t discriminate based on the size of an organization. The data breaches at eBay, Anthem, and Equifax might have garnered many headlines; however hackers also understand that small organizations also have smaller budgets for cybersecurity and therefore make easier targets. <\/span>Multiple sources<\/span><\/a> have reported that the average cost per compromised customer\u2019s Personally Identifiable Information (PII) record was around $150 in the year 2019. This means that if only 10,000 customer records were compromised, a small business could face breach costs starting at $1,500,000. If we increase the number of breached customer records to 50,000, we are looking at costs in the neighborhood of $7,500,000.<\/span><\/p>\n

Compliance Mandates & Fines<\/b><\/p>\n

Apart from the costs of obtaining access to your data, there are often regulatory fines for an organization for which they may be liable.\u00a0<\/span><\/p>\n

Compliance with mandates, such as the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR) are two of the most important regulations. Explicitly written on the official GDPR website, \u201cGDPR fines are designed to make non-compliance a costly mistake for both large and small businesses.\u201d<\/span><\/p>\n

The GDPR explicitly states that some violations are more severe than others. These less severe infringements could result in a fine of up to $11,899,550 (\u20ac10,000,000) or 2% of an organization\u2019s worldwide annual revenue from the preceding financial year, whichever amount is higher. More serious GDPR infringements \u2014 those going against the right to privacy and right to be forgotten \u2014 could result in a fine of up to $23,799,100 (\u20ac20,000,000) or 4% of an organization\u2019s worldwide annual revenue from the preceding financial year, whichever amount is higher.<\/span><\/p>\n

Last year, a new set of regulations, the California Consumer Privacy Act were created. The CCPA fines are just as intimidating as GDPR. Each time a business is found to have an intentional violation, they can be fined up to $7,500. Even unintentional violations come with a price tag of $2,500. Violations can also stack up on one another. For example, if a business\u2019s website is using third-party cookies without leveraging a cookie banner for awareness and opt-in, that organization could be committing thousands (or more) of violations per day.<\/span><\/p>\n

Reputational Damage<\/b><\/p>\n

According to AON\u2019s 2019 Global Risk Management Survey, UK businesses rate brand damage and cyber attacks in the top three risks. The reality is that cyber attacks have enormous potential to damage the reputation of a business, conflating the two risks. The negative impact can be tangible \u2013 a 2019 study reported by Forbes found that a breach can lower a company\u2019s <\/span>share price by 7%<\/span><\/a>. It can be hard for the organisation to regain customers\u2019 trust, particularly if the breach was widespread or caused by basic security errors.<\/span><\/p>\n

PricewaterhouseCoopers (PwC)<\/span><\/a>, an audit and assurance company that works in cybersecurity, reported that 69% of consumers surveyed believe that the companies they use are vulnerable to being hacked and attacked by cyber criminals. The same survey found that 87% of consumers are even willing to walk away and take their business elsewhere if, or when, a data breach occurs. These numbers highlight that consumers are not only skeptical of the organizations that have their critical assets, but that they are willing to leave a company who goes through a data breach. <\/span>With consumers being cognizant<\/span><\/a> of both of these, organizations must implement standards to protect its network from bad actors while also preserving its relationship with consumers.<\/span><\/p>\n

Don\u2019t Neglect Your Security Budget<\/b><\/p>\n

While there is no one-size-fits-all answer when trying to decide what a \u201ctypical budget\u201d looks like for cybersecurity operations, there are a few studies that have been done that can provide some insight. A <\/span>recent study by Deloitte and the Financial Services Information Sharing and Analysis Center<\/span><\/a> found that financial services on average spend <\/span>10% <\/b>of their IT budgets on cybersecurity. That\u2019s approximately <\/span>0.2% to 0.9%<\/b> of company revenue or <\/span>$1,300 to $3,000<\/b> spent per full time employee.<\/span><\/p>\n

Other factors to consider:<\/span><\/p>\n