Want to Avoid an Extreme Cyberloss? Focus on the Basics

Companies that want to avoid the most extreme cybersecurity-related losses should use multifactor authentication, monitor for covert channels indicating a backdoor, patch regularly, and use automated test to detect misconfigurations — in other words, the basics, according to a new analysis of the most damaging breaches of the past five years.

The analysis — conducted by the Cyentia Institute, a data science firm, and based on a dataset from insurance-data firm Advisen — found the most expensive cyber incidents and breaches caused a median loss of $47 million. However, that loss grew quickly for companies that bungled their response to the incident, with the average firm suffering $109 million in damages if they responded slowly, compared with $39 million for all other incidents in the extreme-loss data set.

The data underscores the importance that companies be prepared, says Wade Baker, a partner and co-founder at Cyentia and an associate professor of Integrated Security at Virginia Tech. 

"If we saw evidence that the organization responded poorly — which could mean they bungled it, they were constantly changing their story, or there was a lot of focus on the incompetence of the response — then we saw a pretty big difference [in losses]," he says. "It is a lesson for organizations on the importance of planning and preparing for these events. They are rare, but you make things a lot worse for yourself if you are not ready to respond to them."

The analysis identified a total of 103 incidents that met the thresholds and cost organizations more than $18 billion in total. The data scientists also combed through public information for information about the attack methods used in each cyberattack or breaches, finding the incidents were often caused by a failure to ensure that employees were following basic security precautions. Attackers used some sort of credential attack in 46 incidents, costing $10 billion; a backdoor in 31 incidents, accounting for $9 billion; and exploited a vulnerability in 22 incidents, costing $8 billion, according to the analysis.

The analysis suggests that preventing credential attacks using two-factor authentication, searching for backdoors using monitoring, and preventing application and vulnerability exploitation using an intrusion prevention system or web application firewall could pay off.

"If you are trying to prevent these mega incidents, these are the things that are most associated with those losses," Baker says. "I don't know why an organization would not be using two-factor authentication, but if they are not, I hope this convinces them that it's wise."

Overall, Cyentia found that 8% of all breaches exceeded the $20 million threshold for damages, and the top 5 incidents each exceeded $1 billion in damages. Among those large black-swan incidents are Facebook's $5 billion fine levied by the Federal Trade Commission for the Cambridge Analytica scandal, $2.0 billion in fines and clean-up costs for Equifax, and $1.3 billion in damages from NotPetya suffered by pharmaceutical firm Merck.

While attacks by nation-state actors only accounted for 20 of the 103 incidents, those cyberattacks were among the most expensive, accounting for 43% of the damages, Cyentia found.

"A lot of that is NotPetya, but we normally see a lot more cybercriminals groups," Baker says. "Just to see that level of damages in these really large events where these state-affiliated actors played a prominent role is interesting."

While the exact nature of the damages caused by cyberattacks could often not be determined, 29 of the 103 firms encountered response costs, 22 firms cited productivity or revenue loss, and 19 firms cited fines and judgments. Yet, the last factor is actually the least expensive cost per incident. While productivity and revenue loss accounted for a median loss of $68 million, fines and judgments as a category only accounted for $21 million.

The analysis not only holds strategies for companies, but suggests that the cyber-insurance market can adjust to the potential losses from cyberattacks and breaches targeting their policyholders. While several insurance firms have used "act of war" clauses to attempt to avoid paying out — currently the subject of a handful of lawsuits — such large events are not necessarily that common.

The median cost for companies fell just short of $200,000, according to the analysis.

"The potential impact of these events should be a part of any board-level discussion about cyber-risk," said Jack Freund, head of methodology at VisibleRisk, which sponsored the report, in the analysis's conclusion. "They need to know what a significant, adverse cyber event would look like for their organization. Only then can they truly understand what is required to protect their organization in a holistic way."