Australian companies are getting better at retaining customers even in the wake of a data breach, an IBM security expert has suggested as study findings suggest Australian businesses bucked global trends by driving down the average cost of a data breach some 6.6 percent over the last year – even as overall global costs surged.
The 2016 2016 Cost of Data Breach Study: Australia – a subset of a broader global report conducted by Ponemon Institute on behalf of IBM – found that Australian breaches had declined marginally year on year, from $2.82m to $2.64m. The average per-record cost of data breaches also slid, declining from $144 to $142.
These figures were in stark opposition to the global average of $US4 million – which represented a 29 percent increase since 2013 – and the global average cost of breaches of $US158 per compromised record. In Australia as elsewhere, the cost of data breaches grew with the number of records breached.
Costs averaged $900,000 for breaches involving less than 10,000 records, $2.75m for breaches involving 25,001 to 50,000 records, and $7.18m for breaches involving greater than 50,000 records. A per-capita analysis found that Australian companies with abnormal churn rates of less than 2 percent were able to keep breach costs at around half of those those with churn rates of 3 percent or more.
Industries including media, communications, retail, hospitality, and energy all had abnormal churn rates of less than 3 percent, suggesting that businesses in these industries had been particularly good at containing breaches through proactive customer care or compensation.
“The research suggests that Australian companies are more efficient in the detection and escalation phase of the incident response process,” Glen Gooding, business unit executive with IBM Security Services, told CSO Australia.
Costs had also declined due to a decrease in the engagement of consultants and legal experts, Gooding added, while the overall impact of the churn reduction had led to a slide in average lost business cost from $890,000 to $840,000 per breach.
These figures were well behind the results of the 2014 study, in which IBM and Ponemon Institute found that the cost associated with business loss surged from $760,000 in 2013 to $850,000 in 2014. The average cost per lost or stolen record also increased over that time, from $141 to $145 – as did average total cost, which grew from $2.72m to $2.8m.
Some 46 percent of respondents said they had experienced a malicious or criminal attack while 27 percent of events involved a negligent employee or contractor and 27 percent of breaches were due to system glitches. Companies that had lost data due to malicious or criminal attacks had the highest per-capita cost of recovery, at $162, while those due to employee or contractor negligence costed $123 per capita.
Rapid action also played a factor: the analysis also found that companies with mean time to identify (MTTI) of less than 100 days spent significantly less to fix any breaches – $2.05m versus $3.21m – than those with longer MTTI times. Ongoing analysis of breach-recovery procedures had allowed researchers to draw out regular patterns of activity that had suggested nearly 60 percent of the overall cost of a breach is cleaning up after that breach has happened.
“Everyone is going to need a level of assistance,” said Gooding. “It doesn't really matter what industry you're in; ultimately you will become a target and there will be some level of data exfiltration or malicious activity happening within your organisation. The key is getting to the bottom of what happened and ensuring that you've put the right controls in place to have it not happen again.”
Just as prevention efforts proved capable of reducing the cost of recovery after a breach – an average $13.50 per record reduction for companies that were using encryption extensively – another key factor in successful recovery efforts stemmed from the company's ability to foster a culture of sharing. This included factors like building security awareness and appointing a CISO being more recently complemented by vertical-industry intelligence sharing.
Growing collaboration between industry players was helping identify areas of common experience, helpign reduce the cost and time needed to deal with breaches after they happen - reducing the average cost of a breach by $8.50 per record. This sharing was also driving a focus on executive and board-level engagement, which drives information-security policy towards administration within the broader context of corporate risk.
“Many organisations, even second and third-tier organisations, would never have had a C-level executive focused on information security,” Gooding said, “but now they do. And once the board of directors understand that this is now a corporate risk type of issue, then funding approval flows throughout the organisation to allow those companies to focus on areas of concern.”