In today’s ever evolving threat landscape, organizations must understand the causes of data breaches to effectively implement preventive measures and plan their response. The 2023 Cost of a Data Breach report conducted by the Ponemon Institute and sponsored by IBM Security, provides valuable insights into the increasing cost and impact of data breaches. This study sheds light on the inevitability of data breaches, industry-specific challenges, common causes of breaches, and the significance of incident response preparedness. This blog explores the key findings of the study and offers strategies to help organizations mitigate the impacts of data breaches.
When, Not If: The Inevitability of Data Breaches:
For 83% of companies, the question is not if a data breach will occur, but when. Detecting, responding to, and recovering from threats requires organizations to take swift action to mitigate damages. The United States continues to hold the record for the highest cost of data breaches for the 13th consecutive year. The average cost of a data breach in the U.S. is $9.48 million compared to the global average of $4.45 million USD. Understanding the inevitability of breaches emphasizes the urgency for organizations to prioritize proactive security measures. The top five most expensive industries for a data breach are healthcare, financial, pharmaceuticals, energy and industry in 2023.
Customer and employee PII were the most prevalent and expensive breached records at 52% and 40% respectively. Other company data such as financial information and client lists climbed from 15% in 2022 to 21% in 2023. Although just 6% of attacks were started by hostile insiders these were the most expensive, costing an average of $4.90 million USD. Phishing was the most common attack vector and the second most costly at $4.76 million USD.
Healthcare Industry Under Siege
The healthcare industry has experienced a significant increase in data breaches, with costs rising by 53% since 2020. It remains the industry with the highest average data breach cost for 13 years running. With an average cost of $10.93 million, the healthcare sector faces unique challenges that require customized security measures to successfully safeguard patient data. As one of the most highly regulated industries in the U.S., healthcare organizations must prioritize the integrity and security of healthcare data in compliance with regulations like HIPAA Hi-Tech.
Software Supply Chain Attacks Increase
Software supply chain attacks have emerged as a significant concern in recent years, leading to their inclusion in this year’s report. These attacks involve breaches resulting from compromises within their business partner networks, including suppliers. In this year’s study, 15% of organizations identified a supply chain compromise as the source of a data breach. A business partner supply chain compromise cost 11.8% more and took 12.8% longer to identify and contain than other breach types.
The inclusion of software supply chain attacks in the study underscores their significant impact on breach costs and the extended time required for detection and containment. Organizations must prioritize supply chain security by implementing rigorous vetting processes, conducting regular assessments of business partners’ security practices, and establishing strong collaborative relationships that foster a culture of cybersecurity readiness. By addressing these critical aspects, organizations can effectively safeguard their supply chain ecosystem and reduce the financial and operational risks associated with software supply chain compromises.
Understanding Common Causes of a Breach
A comprehensive understanding of the common causes of data breaches is crucial to effectively address and mitigate these incidents. Stolen or compromised credentials emerged as a leading cause of data breaches in IBM Data Breach study. Cyber criminals often exploit weak authentication mechanisms to gain access to unauthorized access to sensitive information. By obtaining login credentials through phishing attacks or exploiting vulnerabilities in the authentication system, hackers can bypass security measures and infiltrate business networks.
There are often high costs associated with recovering and securing stolen or compromised credentials including the cost of remediation, legal fees, and reputational damage. The time it takes to identify and address breaches is one of the most important metrics after an attack. Prompt detection and response is critical to minimize the impact and potential damage caused by a breach. Organizations must have robust monitoring systems and incident response procedures in place to swiftly identify and address breaches. Taking prompt action significantly reduces the overall consequences and potential financial losses associated with data breaches.
Automation and the Importance of Breach Lifecycle
According to the study, it took an average of 277 days—about 9 months—to identify and contain a breach. Shortening the breach lifecycle is crucial to minimize the financial impact of the cyberattack. By containing a breach within 200 days or less, organizations can significantly reduce costs and mitigate damage. Phishing and stolen credentials were the most common initial attack vectors in this year’s report. Businesses that utilized their automated response playbooks or workflows designed for ransomware attacks were able to contain the attack on average 12 days faster than organizations that did not use automated workflows.
Ransomware and Destructive Attacks
This was the second year that IBM examined the cost of ransomware and destructive malware breaches in their study. Ransomware attacks pose a significant threat to organizations, impacting breach identification and containment efforts. Ransomware and destructive attacks accounted for 24% and 25% of malicious attacks respectively in 2023. The cost of ransomware attacks increased significantly this year and has risen to $5.13 million USD.
This year, IBM studied the impact of asking for help from law enforcement in ransomware attacks. They discovered that organizations who did involve law enforcement saw significant time and cost savings and faced a less expensive ransomware breach overall. When law enforcement was not involved, the average cost of a ransomware breach was $5.11 million USD, compared to $4.64 million USD when law enforcement was involved. Law enforcement also helped shorten time to identify and contain ransomware breaches.
Proactive Strategies to Safeguard your Data
Organizations can implement several proactive strategies to safeguard their critical data and minimize the risk of data breaches. Here are some key tips for business resilience:
- Robust Third-Party Cyber Governance: Implementing strong third-party vendor management practices is crucial for minimizing the risk of data breaches. Establish clear guidelines, conduct thorough risk assessments, and regularly monitor vendors to ensure they adhere to cybersecurity standards.
- Zero-Trust Architecture: Adopting a zero-trust model enhances data security by continuously verifying and authenticating users, devices, and applications before granting access. This approach significantly reduces the risk of unauthorized access and strengthens overall data protection. According to the study, adopting a zero-trust model had the potential to save $1.5 million in data breach costs.
- Encryption and Governance Policies: Implement encryption measures and establish governance policies that include data encryption, internal frameworks for audits, risk evaluation, and compliance tracking. These measures can expedite breach detection and containment efforts.
- User Access and Privileged Account Management: Focus on robust user access management and privileged account management. Implement industry-leading solutions that offer granular access controls and secure management of privileged accounts to reduce the risk of insider threats and unauthorized access.
- Cyber Resilience and Best Practices: Build cyber resilience by establishing effective governance frameworks, policies, and operating models. Integrate cybersecurity practices into all aspects of the organization, aligning with industry best practices. This fosters a culture of cybersecurity and ensures proactive prevention and response to potential threats.
It is important for organizations to regularly review and update their data safety strategies to stay ahead of evolving cyber threats. By implementing these proactive measures, organizations can effectively protect their sensitive data and minimize the financial and repetitional impact of data breaches.
Incident Response: Test, Don’t Just Plan
Having an incident response (IR) plan is just the first step; regular testing is crucial to identify weaknesses and bolster cybersecurity defenses. Organizations that test their IR plans save an average of $2.66 million in data breach costs and identified breaches 54 days faster compared to companies who neglect this essential practice. Developing a detailed cyber incident playbook and regularly testing it through tabletop exercises or simulated breach scenarios can help organizations respond promptly to contain the fallout from a breach. Effective incident response planning and testing can significantly reduce the impact of breaches and limit financial losses. By incorporating these data security measures and strategies, organizations can bolster their defenses, minimize breach costs, and enhance their overall cybersecurity posture.
Final Thoughts
The IBM Data breach study sheds light on the ever-growing threat landscape and provides valuable insights into mitigating the risks of a data breach. Understanding the causes, impact, and cost factors associated with data breaches is important for organizations seeking to protect their sensitive information and minimize financial losses.
By implementing strong incident response plans, performing cybersecurity risk assessments and creating roadmaps, defining governance models, creating right-sized policy and effective reporting, developing zero trust architecture and roadmaps and utilizing the right third-party reviews and reporting organizations can proactively safeguard their data, save valuable time, and limit financial losses in the face of evolving cyber threats.
Written by Eliassen Group
Eliassen Group is a leading strategic consulting company that provides business, clinical, and IT services for our clients as they seek to transform and execute strategies that will drive exceptional outcomes. Leveraging over 30 years of success, we focus on three main areas: technology solutions, clinical solutions, and financial, risk & compliance, and advisory solutions. Eliassen Group prides itself on its purpose to positively impact the lives of our employees, clients, consultants, and the communities in which we operate.
