Ponemon Cost of knowledge Breach Report finds expenses declining for first time

The costs related to an information breach have declined for the primary time in seven years and will be the results of better planning and powerful security leadership, based on the once a year 2011 Ponemon Cost of knowledge Breach Report (.pdf).

$7.2 million in 2010 to $5.5 million in 2011, in keeping with the report. Meanwhile the price per stolen record â€" data that identifies a person whose information was compromised in an information breach â€" declined from $214 per record in 2010 to $194 per record. The study excluded breaches of greater than 100,000 records to circumvent skewed results.

The report, commissioned this year by Symantec, analyzed the information breach costs at 49 U.S.-based organizations and located fewer customers frustrated and fleeing organizations that lost their personal information. Less customer churn, down by about 18%, could be a demonstration that “people are numb to the entire thing,” said Larry Ponemon, founder and chairman of the Ponemon Institute LLC.

“Maybe some people believe they're powerless so that they worry about other things,” Ponemon said.

The Ponemon analysis checked out direct and indirect expenses related to a breach. It took into consideration the engagement of forensic experts, outsourcing hotline support and providing free credit monitoring subscriptions and discounts for future services and products. It also checked out indirect costs related to IT response and communication.

Organizations that properly execute a proper incident response plan and feature somebody in a leadership position or a CISO to go response and likewise drive security into the culture of the organization seem to limit the unwanted side effects of a breach, Ponemon said. Organizations with CISOs can reduce costs by up to 35% per compromised record, the report found. Engaging an external consultant to aid handle the breach also reduced costs.

“It's all concerning the governance of the organization and the way it addresses data protection and privacy issues,” Ponemon said. “Organization's should probably have one security leader; we all know that businesses that experience CISOs are different culturally than companies that do not.”

The results also found that organizations should take an intensive assessment before initiating data breach notification. Organizations that respond too quickly typically notify too lots of people that they are able to be potential victims, increasing the price spent per record. Forty-one percent notified victims within 30 days or less, after thoroughly investigating the incident, Ponemon said. “A rapid response ends in incurring more costs,” he said. “Being systematic and surgical about identifying who's in peril can reduce costs.”

Security technology can also be an element within the decline in data breach cost, noted Ponemon. Data loss prevention technology, which may identify sensitive data after which monitor for leaks can reduce the scope of a breach, Ponemon said. Similarly, organizations seem like deploying stronger authentication, two-factor authentication, encryption and tokenization around mastercard data and personally identifiable information (PII), he said.

External attacks using malware were utilized in at the very least 1/2 the organizations analyzed within the study. Ponemon noted that organizations are deploying better technologies to spot attacks and block them or mitigate infection before it becomes a significant problem.

“We think that the frequency of malicious attacks is increasing and corporations are becoming better at detecting those attacks,” Ponemon said. “They're also getting smarter of their ability to spot the basis cause.”

Among the reports other findings, 41% of organizations had an information breach as a result of a 3rd party, indicating that some companies have little knowledge in their partner's security processes, Ponemon said.

Negligence also caused breaches. Thirty-nine percent of organizations had a knowledge breach because of a lost or stolen mobile device, which included laptops, smartphones, tablets and UBS drives that contained confidential and sensitive information. Only 18 organizations, or 37%, indicated the breach was by the hands of a malicious insider or hacker.

Dig Deeper

• Individuals who read this also read...