- More US-based organizations are investing in their IT security and physical security measures, but the costs of cybersecurity attacks are still on the rise, according to recent research.
CSO, the CERT Division of the Software Engineering Institute at Carnegie Mellon University, the US Secret Service, and Forcepoint collaborated on the 2017 U.S. State of Cybercrime survey. More than 500 US executives, security experts, and others from the private and public sectors were interviewed on their cybersecurity approaches.
Twenty-one percent of respondents said their monetary losses from cybersecurity incidents increased year over year. Financial losses were estimated at an average of $884,000, an increase from the estimated $471,000 from last year.
"As organizations prepare for various attacks and breaches, hackers continue to be savvier in their approaches,” CSO SVP and Publisher Bob Bragdon said in a statement. “Resilient organizations must have all employees embrace security practices, from awareness training to behavior monitoring to gap protections."
Nearly half of respondents (48 percent) said they are seeing budget increases, with an average IT security budget of $11 million. Physical security budgets are averaging $9 million, the report found.
Firewalls, spam filtering, network-based antivirus tools, access controls, and encryption were listed as the most effective solutions for detecting or deterring external threat factors. Fifty-eight percent of those surveyed also said that they monitor user behavior in an effort to catch potential insider threats.
Approximately three-quarters of organizations (79 percent) said that an outsider committed a cybersecurity incident. These types of intrusions though go undetected for an average of 92 days, according to the research.
The top three types of cybersecurity incidents also differ depending on whether it was an insider or outsider threat.
The report found that outsider threats tend to consist of the following:
- Unauthorized access to/use of information, systems, or networks
- Customer records compromised or stolen
- Confidential records (trade secrets or intellectual property) compromised or stolen
Cybersecurity incidents stemming from insider threats will include private or sensitive information being unintentionally exposed, customer records being compromised or stolen, and employee records being compromised or stolen.
"It is encouraging, by looking at the survey results, that most organizations are recognizing the threat posed by insiders, but it is concerning that 31 percent of the organizations responding to the survey had at least one insider incident in 2016, with 76 percent of those incidents being handled internally, without involving legal action or law enforcement," CERT Insider Threat Center Technical Manager Randy Trzeciak said in a statement.
Other research has shown that cybersecurity attacks continue to plague numerous industries, including healthcare, with high costs in the recovery process.
The average cost of a data breach is $3.62 million globally, according to the 2017 Cost of a Data Breach Study: Global Overview sponsored by IBM Security and conducted by Ponemon Institute. Healthcare data breaches cost organizations $380 per record, which is more than 2.5 times the global average across industries at $141 per record.
Following healthcare, the industries with the highest costs were financial services ($336 per capita), services ($274), life science ($264), and industrial ($259). The mean per capita data breach costs were $225.
"Data breaches and the implications associated continue to be an unfortunate reality for today's businesses," Ponemon Institute Chairman and Founder Dr. Larry Ponemon said in a statement. "Year-over-year we see the tremendous cost burden that organizations face following a data breach.”
“Details from the report illustrate factors that impact the cost of a data breach, and as part of an organization's overall security strategy, they should consider these factors as they determine overall security strategy and ongoing investments in technology and services."