Responding quickly to
breaches costs enterprises more than a slower response. That's one of the findings of a new study from Symantec and the Ponemon Institute, released Tuesday.
The study, entitled U.S. Cost of a Data Breach, found that costs for data breaches continued to rise for the fifth consecutive year. Average organizational cost climbed seven percent this year to $7.2 million, with an average of $214 per compromised record -- compared to $204 in 2009.
This is the sixth such report, and it's based on responses from 51 companies in the U.S., representing 15 different industry sectors and 51 data breach cases ranging from 4200 to 105,000 affected records. As might be expected, the cost of an incident rose in proportion to the number of records lost.
Francis deSouza, senior vice president of the Enterprise Security Group at Symantec, said in a statement that "companies with best practices in place can greatly lower their potential data breach costs." Symantec's recommended best practices include identifying risks, classifying confidential information, educating employees and holding them accountable, deploying data loss prevention technologies, encrypting laptops, and integrating data protection practices into business processes.
Among the key findings, the study found that a rapid response costs 54 percent more per record than a slower response. Of the surveyed companies, forty-three percent notified victims within one month of the breach discovery, which is seven percent higher than in 2009. But speed has its price, with an average per-record cost of $268 per record, an increase of 11 percent over the previous year. Slower companies' cost was an average of $174 per record, down 11 percent.
The report also found, unsurprisingly, that malicious attacks are rising and are the most expensive, with 31 percent of all cases in that category. This is seven percent over the previous study, and the average $318 cost per record was a whopping 43 percent increase.
Most Common Threat -- Negligence
The most common threat, however, was negligence, representing 41 percent of all cases. The report noted that this trend "reflects the ongoing challenge of ensuring employee and partner compliance with security policies."
But there is some good news in the report. System failure was down nine points to 27 percent. The report said this "indicates organizations may be more conscientious in ensuring their systems can prevent and mitigate breaches through new security technologies and compliance with security policies and regulations."
Training and awareness programs, as well as encryption, are the most popular post-breach fixes.
Chris Christensen, an analyst with IDC, said that one would expect the cost of data breaches to rise, "because of an increased regulatory environment and the cost of notification."
He said that, while there were no major surprises, it was "interesting that companies that did breach notification early spent more." Christensen said the implication is that faster companies had more "redundant activities" in the ensuing rush, such as "notifying more people than needed to be." On the other hand, he noted that "waiting has its own dangers," and the proper timeframe for a response would require study and decisions largely on a case-by-case basis.
The big takeaways from the study, Christensen said, are that enterprises should develop a breach notification plan, test it as they would a disaster recovery plan, and build tools to effectively assess how significant a breach was, who was affected, and what the most efficient notification process might be.
The study was sponsored by Symantec and conducted independently by the Ponemon Institute.