Security: Cybercrime Costs and Incidents SkyRocket

Over the last year there has been a spike in the frequency and severity of cybercrime incidents.  The number of incidents reported increased by 56 percent and the average annual cost to a mid-size business now totals $6 million.  That estimate represents damages from “direct, indirect, and opportunity costs that resulted from the loss or theft of information, disruption to business operations, revenue loss, and destruction of property, plant, and equipment.”

Those estimates were made in a report sponsored by HP’s recently acquired security and compliance business, HP ArcSight, and the study was conducted by the Ponemon Institute.  The study found that over the last year the time needed to respond to a cyberattack on an medium-sized organizations increased from 14 days to 18 days, and the daily cost of responding to cyberattacks has increased from $17,600 to $23,000. The average cost for resolving the consequences of a data breach now averages $416,000.

Symantec senior director Bernard Laroche, said that small and mid-sized organizations are facing increased risks to their confidential information—including bank accounts, credit card information and customer and employee records.”  The average annual cost of incidents to small businesses is $188,242.

A survey by ComRes in the UK found that roughly 50 percent of adults feel less secure in their online transactions compared to a year ago.  Small business, local governments and school districts are increasingly often the targets of attacks.  Cyber security in these smaller organizations tends to be less sophisticated, making them easy targets for organized crimes.  By some accounts, these small organizations are losing as much as $1 billion annually from cyber breakins — with many of these  incidents going unreported by the media.

Small and Medium sized companies are not the only ones being targeted.  Large organizations are being targeted too, and should they become a victim of cybercrime, they generally have much more to lose.  McAfee reports that a “state actor”, most likely China, is behind numerous unauthorized entries into the computer systems of governments like the United States, Taiwan, India, South Korea, Vietnam and Canada; the Association of Southeast Asian Nations (ASEAN); the International Olympic Committee (IOC); the World Anti-Doping Agency; and other companies including defense contractors and high-tech enterprises.

In a report released by the white house in July, the National Security Council (NSC) describes the federal governments assessment of transnational organized cyber crimes.  The report identifies an important action item for the Obama administration is to “enhance domestic and foreign capabilities to combat the increasing involvement of TOC (transnational organised crime) networks in cybercrime and build international capacity to forensically exploit and judicially process digital evidence.”