How do you quantify the true cost of a data breach? How do you measure the costs against the benefits of eliminating risks, mitigating risks or accepting risks to your business effectively?
The Lazarus Alliance executive leadership team has been the proverbial tip of the spear within the proactive cyber security realm well before there were actually corporate security departments and before the role of Chief Information Security Officer (CISO) entered our collective taxonomy.
It seemed only logical when you think like a futurist that our technological proliferation would only accelerate (it certainly has!) and that cyber security would predominantly factor into this equation (the understatement for the day!).
As with any analytical pursuit, the more data you have to analyze the better the outcome will be. Measuring the cost of a data breach is no exception to this rule. The cyber security industry and the practitioners within it now have ample data sets to draw from. The big task that remains is really a question (actually several but who is counting?) again and they are whether or not the security leadership within your organization has the:
- The competency to do the job
- The capability to do the job
- The fortitude to do the job
Therein lies the wildcard. The human element once again is the weakest link in the chain between absolute cyber security and the lack thereof. It is important to point out that the first rule in the laws of security are that there is no such thing as absolute cyber security unless you cut the cord.
Now that we are at a place that resembles despair, let’s examine some facts that will help corporate leadership beginning with the Chief Executive Officer (CEO) down through the corporate ranks. It behooves us to distill the many facets of cyber security into the most obvious and most simplest of forms; proactive cyber security and reactive cyber security.
Reactive Cyber Security
By definition, reactive cyber security is when it’s too late for preventive measures. You company is in the news and on the next industry breach report. The CEO, CIO and CISO are most likely going to be on the head chopping block. If your company survives, there will be huge litigation costs and long term reputation damage that is almost impossible to quantify.
Depending on what breach statistical report you choose, on average the cost of a singular human database record is $205 USD. Using some very complex mathematics (A*B=C) we can estimate the costs of a data breach which will help us make decisions on how to be proactive in the pursuit of risk elimination to our organizations.
For example, recently published on CNN was “Government investigators now believe that the data theft from the Office of Personnel Management computer systems compromised sensitive personal information, including Social Security numbers, of roughly 21.5 million people from both inside and outside the government, the government announced Thursday.”
Let’s do the math!
$205.00 multiplied by 21,500,000 records equals the estimated cost of the Office of Personnel Management data breach is going to be $4,407,500,000.00! (Expletives omitted at this point!)
What are some additional ancillary costs of this breach:
- The Office of Personnel Management will never be trusted again
- The CIO and CISO should lose their jobs in utter disgrace due to their egregious negligence
- The US taxpayers will be strapped with the costs for decades
We have some eye popping and sleep losing facts to take away from this data that we can apply to the organizations we are responsible for. You should have a reasonable idea of how many records you are the custodian of so use this information to calculate another mathematical decision making tool; annualized loss expectancy (ALE).
ALE is an integral part of a proactive risk assessment so lets move on to proactive measures; more on ALE in a moment.
Proactive Cyber Security
By definition, proactive cyber security is all about preventing a data breach through the effective and appropriate implementation of controls and countermeasures. It’s all about keeping your company out of the news and off those industry breach reports.
Think about what it costs to have a third part risk assessment or compliance audit. From a holistic perspective it is trivial when compared to the cost of a data breach. The numbers don’t lie. Taking a proactive approach to cyber security is far less expensive on order of magnitudes. What we are finding is that the cost on average to proactively address security, risk, audit and governance is less than the cost of a single CISO level employee!
To quote William Ochs, a partner in the Lazarus Alliance GRC practice, “With every successive breach we continue to see that organizations miss the adage that an ounce of prevention is worth a pound of cure. It seems that in the complexity of cyber security, the most common sense proactive steps are ignored and we keep paying by the pound.”
The best place to begin is with an IT Risk Assessment. Properly conducted, and surveys indicate that 59% of all organizations do not, would eliminate most threats to the business. Quite specifically when you analyze the big breaches over the past 12 months you will find that 100% are attributed to human hacking and 96% could have been prevented by implementing simple and medium grade controls. All of these are easily identified through a proper risk assessment.
Part of every risk assessment includes calculating costs and expenses to eliminate risks which is finally where ALE comes in. While ALE was originally meant for accountants only, the executive leadership of Lazarus Alliance discovered that it made perfect sense for cost center lines of business like cyber security.
To provide a brief explanation of how it is calculated, there are two factors that comprise the ALE. They are the Single Loss Expectancy (SLE), which is the percentage of the asset you are attempting to protect that would be lost in a single exposure, and the Annualized Rate of Occurrence (ARO), which is the frequency the loss event occurs in a year. Those two factors multiplied together give you’re the ALE (ALE = SLE * ARO).
For example, suppose than an asset is valued at $200,000 and the single cost of exposure is $50,000. Your SLE is now defined as $50,000 right? How many times in a year do we expect this exposure event to occur in a year? If we expect an exposure to occur once every year, then ARO is 100% whereas if we think there is a 50/50 shot, our ARO is now 50% right? For discussion purposes, let’s suggest we think there is a 50/50 chance an exposure might occur so our ARO is .5. With our SLE equaling $50,000, multiplied by our ARO of .5, the ALE is $25,000.
If you were to spend more than $25,000 for risk mitigation or avoidance by purchasing some security product, insurance or some legal service, you are spending too much. You are most certainly spending too much if the product or service you deploy does not eliminate the risk. If spending $25,000 does not set your ARO to zero, but say, cuts the risk down by 75% instead, you should reduce that $25,000 mitigation expense by 25% to bring everything back into a cost-effective risk avoidance measure.
We have explored the wildly different costs between proactive cyber security and reactive cyber security. Companies can no longer afford to go-it-alone when the stakes are so high. It’s not enough for the government or the private sector to enact rules and regulations; you need qualified assistance to make it happen.
Lazarus Alliance is Proactive Cyber Security®