Credit: ID 61285117 © Mast3r | Dreamstime.com
The cost of data breaches to Australian companies has surged over the past year to be well above global averages, according to new research in which 47 percent of Australian CISOs said breaches had costed them more than US$5m (A$7m).
That percentage – one of numerous findings in Cisco’s 2019 CISO Benchmark Study – had increased from 17 percent a year ago, and is well ahead of the global average of 8 percent of breaches costing that much.
The increase occurred during period in which Australia’s notifiable data breaches (NDB) scheme has dramatically increased scrutiny of data-breach costs and reporting obligations.
Not all companies saw the cost of breaches rising: fully 39 percent of Asia-Pacific companies reported costs of less than US$500,000 (A$700,000). The fact that this percentage increased from 33 percent the previous year suggested that many companies have improved their breach detection and containment capabilities – further evidenced by reports that many security leaders have shifted their conceptual frameworks for dealing with breaches.
Fully 48 percent of Asia-Pacific CISOs are measuring their breach handling in terms of time to remediate rather than time to detect – up from 36 percent last year. This philosophical change may be driving faster response and more directed recovery, with just 4 percent of companies reporting that they had an outage that lasted more than 24 hours.
“Cybersecurity is a numbers game that is skewed in favour of malicious actors,” said John Maynard, vice president of Cisco’s Global Security Sales Organisation, noting that costs include out-of-pocket expenses, legal fees, reputational damage, and loss of business.
“Every time attackers succeed, there is a financial impact on the company targeted,” he continued. “The fact that an increasing number of companies are able to contain this cost is a sign that businesses are starting to gain more control and balance their risks when hit by a breach.”
That’s positive news for an industry that has struggled to get on top of the growing flood of security alerts coming from a growing number of devices, Maynard told attendees at this week’s Cisco Live! conference in Melbourne while citing CISO Benchmark Study figures that suggested 93 percent of Asia-Pacific CISOs found it challenging to deal with alerts from multiple vendor products – well ahead of the global average of 79 percent.
Reconciling these issues remains a key priority for CISOs that face increasingly creative cybercriminals, and Cisco has been pitching the merits of a software-based infrastructure as a more-flexible option that allows for better integration across security platforms.
CISOs should also use their market weight, experts advised, using more-specific RFPs to push industry players to improve the security elements of their new projects and overcome the challenges of disparate platforms.
“Companies have traditionally approached building their security capabilities in a piecemeal manner by adopting solutions to address specific challenges at the time,” said Stephen Dane, APJC managing director of Cisco’s Global Security Sales Organisation, in a statement.
“While this may help patch individual vulnerabilities, it creates a bigger issue as having more point solutions that don’t work together increases their security effectiveness gap.”
“We need to remember that cyber criminals are constantly working together and are relentless in their pursuits of hacking networks and inflicting damage on their targets. Defenders need to take a similar approach by collaborating more, sharing intelligence and ensuring they stay a step ahead of the attackers.”