Web attacks, malware and insider threats can cost organizations millions of dollars in losses each year, according to a Ponemon Institute study released Monday.
The survey of 45 U.S. organizations, sponsored by security and compliance solutions provider ArcSight, found that cybercrime costs organizations $3.8 million per year on average. IT security practitioners at each of the participating entities were interviewed as part of the study, which found that the cost of cybercrime ranged from $1 million to $52 million per year per company.
Larry Ponemon, chairman and founder of the Ponemon Institute, told SCMagazineUS.com on Monday that some of the organizations studied were surprised at the total economic impact of digital offenses.
“Basically, the No. 1 takeaway is that cybercrime is very costly,” Ponemon said.
The analysis attempted to capture the direct and indirect costs of cybercrime, including information theft or loss, business disruption and property destruction – all of which constitute “external” costs. In addition, the cost of “internal” cybercrime mitigation activities, including detection, investigation, containment, recovery and post-incident response, were quantified.
Cybercrime detection and recovery were the most costly internal activities, while information loss was the most expensive external cost, the study found.
Companies included in the study fell victim to 50 attacks per week, or the equivalent of more than one successful attack per company each week. More than 90 percent of all cybercrime costs resulted from web-based attacks, malicious code and malicious insiders.
Organizations that were analyzed took 14 days on average to resolve cyberattacks, with the average cost per day totaling $17,696, according to the study. Malicious insider attacks, however, took up to 42 days or more to resolve.
“Every organization should be concerned about cyberattacks and how much it will cost to manage and contain them,” Tom Reilly, president and CEO of ArcSight, said in a statement.
On a more positive note, the study found that organizations are able to reduce the financial impact of cybercrime with a strong security posture.
Appointing a CISO, deploying an enterprise security strategy, and investing in technologies that address sophisticated threats and manage security events could reduce the impact and cost of cyberattack, Ponemon said.