Responding quickly to data breaches costs enterprises more than a slower response. That's one of the findings of a new study from Symantec and the Ponemon Institute, released Tuesday.
The study, entitled U.S. Cost of a Data Breach, found that costs for data breaches continued to rise for the fifth consecutive year. Average organizational cost climbed seven percent this year to $7.2 million, with an average of $214 per compromised record -- compared to $204 in 2009.
This is the sixth such report, and it's based on responses from 51 companies in the U.S., representing 15 different industry sectors and 51 data breach cases ranging from 4200 to 105,000 affected records. As might be expected, the cost of an incident rose in proportion to the number of records lost.
Francis deSouza, senior vice president of the Enterprise Security Group at Symantec, said in a statement that "companies with information protection best practices in place can greatly lower their potential data breach costs." Symantec's recommended best practices include identifying risks, classifying confidential information, educating employees and holding them accountable, deploying data loss prevention technologies, encrypting laptops, and integrating data protection practices into business processes.
Among the key findings, the study found that a rapid response costs 54 percent more per record than a slower response. Of the surveyed companies, forty-three percent notified victims within one month of the breach discovery, which is seven percent higher than in 2009. But speed has its price, with an average per-record cost of $268 per record, an increase of 11 percent over the previous year. Slower companies' cost was an average of $174 per record, down 11 percent.
The report also found, unsurprisingly, that malicious attacks are rising and are the most expensive, with 31 percent of all cases in that category. This is seven percent over the previous study, and the average $318 cost per record was a whopping 43 percent increase.
Most Common Threat -- Negligence
The most common threat, however, was negligence, representing 41 percent of all cases. The report noted that this trend "reflects the ongoing challenge of ensuring employee and partner compliance with security policies."
But there is some good news in the report. System failure was down nine points to 27 percent. The report said this "indicates organizations may be more conscientious in ensuring their systems can prevent and mitigate breaches through new security technologies and compliance with security policies and regulations." (continued...)