Ponemon Institute© Research Report Page 2
Summary of key findings
Following are the most salient findings of this year’s study. In several places we compare thepresent finding compiled from a sample of 50 benchmark organizations to a separate sample of 45 organizations published in July 2010.
Cyber crimes continue to be very costly for organizations
. We found that the medianannualized cost for 50 benchmarked organizations is $5.9 million per year, with a range from $1.5million to $36.5 million each year per company. Last year’s median cost per benchmarkedorganization was $3.8 million. Thus, we observe a $2.1 million (56 percent) increase in medianvalues.
Cyber crime cost varies by organizational size.
Results reveal a positive relationship betweenorganizational size (as measured by enterprise seats) and annualized cost. However, based onenterprise seats, we determine that smaller-sized organizations incur a significantly higher per capita cost than larger-sized organizations ($1,088 versus $284).
Cyber crimes are intrusive and common occurrences
. The companies participating in our study experienced 72 successful attacks per week – or more than 1.4 successful attacks per organization. When compared to last year’s study, this represents a 44 percent increase insuccessful attacks experienced by organizations.
The most costly cyber crimes are those caused by malicious code, denial of service,stolen or hijacked devices and malicious insiders.
These account for more than 90 percent of all cyber crime costs per organization on an annual basis. Mitigation of such attacks requiresenabling technologies such as SIEM and enterprise GRC solutions.
Cyber attacks can get costly if not resolved quickly.
Results show a positive relationshipbetween the time to contain an attack and organizational cost. The average time to resolve acyber attack is 18 days, with an average cost to participating organizations of $415,748 over this18 day period. This represents a 67 percent increase from last year’s estimated average cost of $247,744, which is compiled for a 14 day period. Results show that malicious insider attacks cantake more than 45 days on average to contain.
Information theft continues to represent the highest external cost, followed by the costsassociated with business disruption.
On an annualized basis, information theft accounts for 40percent of total external costs (down 2 percent from 2010). Costs associated with disruption tobusiness or lost productivity account for 28 percent of external costs (up 6 percent from 2010).
Recovery and detection are the most costly internal activities
. On an annualized basis,recovery and detection combined account for 45 percent of the total internal activity cost withcash outlays and labor representing the majority of these costs.
Enterprise deployment of SIEM makes a difference
. The cost of cyber crime is moderated bythe use of SIEM technologies. We found a percentage cost difference between SIEM and non-SIEM companies of 24 percent. Findings suggest companies using SIEM were better able toquickly detect and contain cyber crimes than those companies not using SIEM. As a result, SIEMcompanies experienced a substantially lower cost of recovery, detection and containment thannon-SIEM companies. In addition, SIEM companies were more likely to recognize the existenceof advance persistent threats (APTs) than non-SIEM companies.
Observed differences in median or average value do not reflect a trend since it is calculated from twodifferent samples of companies.