The escalating economic impact of cyber crime

Source: HP infographic.

HP has unveiled the results from its sixth annual study in partnership with the Ponemon Institute detailing the economic impact of cyber attacks across both the private and public sectors. 

The findings reveal a dramatic increase in the overall cost of cyber crime, and reveal that small organisations incur a significantly higher per capita cost than larger organisations³.

Conducted by the Ponemon Institute and sponsored by HP Enterprise Security, the 2015 Cost of Cyber Crime Study quantifies the annual cost of cyber crime for companies across seven countries: the US, UK, Japan, Germany, Australia, Brazil and the Russian Federation.

In the study, researchers found the average annualised cost of cyber crime incurred by a benchmark sample of Australian and Japanese organisations had increased by 13% and 14% respectively since last year. The results also revealed that it took an average of 31 days to resolve a cyber attack in Australia as compared to 26 days in Japan^{1, 2}.

“As organisations increasingly invest in new technologies like mobile, cloud, and the Internet of Things, the attack surface for more sophisticated adversaries continues to expand,” said Matthew Shriner, Director, Enterprise Security Products, Asia Pacific and Japan, and Europe, Middle East and Africa, HP. “To address this challenging dynamic, we must first understand the threats that pose the most risk and then prioritise the security strategies that can make a difference in minimising the impact.”

Key findings from the 2015 Australia and Japan Cost of Cyber Crime Studies:

· Cyber crimes continue to be very costly: The average annualised cost of cyber crime incurred in Japan was US$6.81 million, compared to US$3.47 million in Australia^{1, 2}.

· Cyber crimes require more time to resolve: The average time to resolve a cyber attack was 31 days in Australia, compared to 26 days in Japan. This represents an increase of eight days in Australia and one day in Japan over the last year. Results also showed that malicious insider attacks can take an average of 50 days to contain in Australia, compared to 37 days in Japan^{1, 2}.

Understanding the cyber threats that pose the biggest risk and have the most economic impact to organizations can help enterprises better plan their security approach and investments.

· In both Japan and Australia, the most costly cyber crimes continued to be caused by denial of service and malicious insiders^{1, 2}.

· In Australia, business disruption continued to represent the highest external cost, followed by the costs associated with information loss. On an annual basis, business disruption accounted for 38% of total external costs¹.

· In Japan, information theft represented the highest external cost, followed by the costs associated with business disruption. On an annual basis, information theft accounted for 48% of total external costs².

· Recovery and detection were the most costly internal activities in both countries. Australia reported that it accounted for 48% while Japan reported it accounted for 53% of the total annual internal activity cost. In both countries, productivity, cash outlays and direct labour represented the majority of these costs^{1, 2}.

Organisations investing in and using security intelligence technologies and governance practices to address the crimes that proved most costly were more efficient in detecting and containing cyber attacks, thereby reducing costs otherwise incurred¹.

· Deploying a security information and event management (SIEM) solution led to an average cost savings of US$1.9 million per year³, compared to companies not deploying similar security solutions.

· Employment of certified/expert security personnel trigger savings of US$1.5 million³.

· The appointment of a high-level security leader can reduce costs by US$1.3 million³.

“With cyber attacks growing in both frequency and severity, understanding of the financial impact can help organisations determine the appropriate amount of investment and resources needed to prevent or mitigate the consequences of an attack,” said Dr Larry Ponemon, chairman and founder, Ponemon Institute. “As seen in this year’s study, the return on investment for organisations deploying security intelligence systems, such as SIEM, realised an average annual cost savings of nearly US$4 million – showcasing the ability to minimise impact by more efficiently detecting and containing cyber attacks.”

Across all seven countries studied, the US sample reported the highest total average cost of cyber crime at US$15 million per company. The Japan sample ranked third globally at US$6.81 million while the Australia sample ranked second lowest out of seven countries, reporting an average cost of cyber crime at US$3.47 million³.

Interested?

Hear more detail on the Cost of Cyber Crime Study’s findings and how actionable security intelligence can help to minimise the impact of cyber crime through a webcast being held Wednesday, October 14 at 12 pm EDT (12am October 15 Singapore time). 

Find out more about the country-specific findings of the Cost of Cyber Crime Study or copies of the full reports, along with an interactive assessment tool

View the associated infographic

1 2015 Cost of Cyber Crime Study: Australia, Ponemon Institute, September 2015.
2 2015 Cost of Cyber Crime Study: Japan, Ponemon Institute, October 2015.
3 2015 Cost of Cyber Crime Study: Global, Ponemon Institute, October 2015.
4 2014 Cost of Cyber Crime Study: Australia, Ponemon Institute, October 2014.
5 2014 Cost of Cyber Crime Study: Japan, Ponemon Institute, October 2014.

Crowdfunding portal set up to help human trafficking victims

Microsoft and the International Organization for Migration (IOM) today announced the launch of 6Degree.org, the first crowdfunding portal that enables the public to directly support the voluntary return and sustainable reintegration of human trafficking victims.

6Degree is the result of a public-private partnership between Microsoft and IOM. The development of the portal was led by IOM X, which is IOM’s new campaign to encourage safe migration and public action to stop exploitation and human trafficking, produced in partnership with the United States Agency for International Development (USAID).

“The growing operational challenges of migration management demand out-of-the-box thinking on how best they can be tackled,” said Stefan Sjöström, Vice President for Public Sector, Microsoft Asia. “The use of technology shows enormous potential in this respect, and combining Microsoft’s deep expertise in deploying cloud computing technology to support public sector endeavors inspires confidence in our efforts to aid human trafficking victims.”

IOM has provided more than 70,000 survivors of human trafficking with humanitarian, medical, legal and migration support since 1997. On average, IOM helps 6,000 to 7,000 individual trafficking survivors every year. With the additional funding, the cost of shelter, medical and legal assistance, repatriation, and education or skills development to prevent re-trafficking can be covered to meet demand.

“6Degree is the first time we have been able to provide individual donors with direct access to supporting a proven and time-tested mechanism for helping individual survivors of trafficking,” said Andrew Bruce, Regional Director, IOM Regional Office for Asia and the Pacific. “I am excited by the possibilities this technology opens up for organisations such as IOM, and the opportunity to give more victims of human trafficking a second chance at life.”

Source: 6Degree.org website. Each survivor’s story is told through interactive story maps, which strike a balance between protecting the victim’s identity, and telling a compelling story to potential funders. 

6Degree is the first crowdfunding portal that meets the strict requirements of IOM’s victim protection and privacy standards. Because a survivor’s anonymity is their most important form of protection, 6Degree does not use photographs of faces and modifies information that could compromise their safety or chances of a normal life. Instead, each survivor’s story is told through interactive story maps, which strike a balance between protecting the victim’s identity, and telling a compelling story to potential funders.

The interactive map allows users to follow the journey of each former victim, with significant milestones illustrated by clickable icons. When clicked, the user is presented with a narrative elaborating on the survivor’s experience at that point in their journey. By following the stories icon by icon, the user can understand the circumstances that led to the person being trafficked, appreciate the challenges faced during exploitation, learn how they reclaimed their freedom and discover what their dreams and ambitions are for the future.

“6Degree is about connecting individual users with individual human stories,” said Tara Dermott, IOM X Program Leader. “Parallel to the funding aspect, these stories will help develop awareness, build understanding and nurture commitment towards stopping human trafficking through the many actions of a united collective.”

Singapore police raid local computer vendor, find counterfeit Microsoft software

Microsoft has called on consumers and small businesses to be wary of the unintentional purchase and use of counterfeit software. This advisory was issued following a raid of a computer vendor located at Kembangan Plaza yesterday by the Intellectual Property Rights Branch (IPRB) of the Singapore Police Force. 

It is understood that the company operating at the shop had advertised the sale of unauthorised “Microsoft license keys”, claiming they were genuine. Customers could also purchase branded computers and laptops bundled with counterfeit software at highly discounted prices via an online store. These computers were sold with fake Certificates of Authenticity that could mislead customers into believing the software installed were genuine.

During the raid, the authorities also seized 43 units of laptops installed with suspected counterfeit copies of Windows 7 Pro and Office Enterprise 2007 and affixed with fake Certificates of Authenticity. The total commercial value of the seized goods is estimated at S$80,000. The Lenovo, Dell and HP laptops seized are believed to be originally preinstalled with DOS operating systems.

Pirated software often leads to increased security risks and threats from malware and viruses. Honest computer vendors are also put to a disadvantage as they are unable to compete with dealers offering counterfeit software that are often lower in cost. In this case, Microsoft was alerted by a concerned computer vendor when their customer demanded a refund of a genuine copy of software he bought because he claimed the same software was sold by the raided vendor at a cheaper price.

Roland Chan, Senior Director, Compliance Programs – Asia-Pacific, BSA | The Software Alliance (BSA) said, ”Most people do not know what is installed on their systems, and that needs to change. While Singapore has one of the lowest rates of unlicensed software use in the Asia-Pacific region, it is still important for both consumers and businesses to be vigilant in view of the security and malware risk counterfeit software potentially brings. 

"According to our BSA Global Software Survey, the risk of security threats from malware is the chief reason why computer users around the world avoid the use of unlicensed software. Among the risks associated with this, 64% of users cited unauthorised access by hackers as a top concern and 59% cited the loss of data. Consumers and business should actively take steps to prevent the potential risks at hand and to protect themselves from unwanted exposure to potential loss of privacy and data.”

Singapore has one of the most stringent copyright laws in the world. Offenders, if found guilty in the court of law for the manufacture for sale, sale of infringing copies and possession or importation of infringing copies, are liable to a fine not exceeding S$10,000 for each infringing copy, up to a total of S$100,000 per charge, or imprisonment for up to five years. Offenders may also be liable to both a fine and imprisonment if found guilty.

The recent raid was one of several that has been conducted by the authorities in recent months. In September this year, a 20-year-old man pleaded guilty and was fined S$20,000 for selling unauthorised software products or license keys in several local online websites, the maximum fine under the Copyright Act for a first-time offender.

Jonathan Selvasegaram, Corporate Attorney at the Microsoft Digital Crimes Unit (DCU) said, “Software piracy is a major concern for everyone, because of the damage it could cause for unsuspecting users. Such software could expose computers to spyware, malware and viruses that can lead to identity theft, loss of personal data, and unexpected system failures. The risk is very real as this has dangerous repercussions, especially for businesses where operational disruptions caused by malware and viruses could potentially lead to heavy financial losses for them. 

"In fact, a quick anti-malware scan on a new branded laptop purchased earlier from the raided vendor revealed that it contained adware. While good adware can enable you to enjoy apps for free, bad adware can turn your system into a zombie computer that is part of a botnet and is sending out spam, phishing emails, and even attacking other computers. The DCU team hopes to be able to examine the computers seized by the Police in greater detail once the case is over.

Selvasegaram made the remarks in reference to a joint study conducted by International Data Corporation (IDC) and the National University of Singapore (NUS) released in March this year which found that enterprises in Asia Pacific (APAC) are expected to spend nearly US$230 billion to deal with issues caused by malware deliberately loaded onto pirated software. Breaking this down further, the majority of the cost (US$170 billion) will go into dealing with data breaches, while the remainder will be utilised to deal with security issues. 

The study, titled The Link Between Pirated Software and Cybersecurity Breaches, also revealed that 65% of APAC consumers surveyed said their greatest fear from infected software is the loss of data, files or personal information, followed by unauthorised Internet transactions (48%) and potential identity theft (47%).

According to the study, government officials also expressed concern about the potential impact of cybersecurity threats to their nations. The survey outlined that APAC governments are most worried about the unauthorised access to confidential government information (57%), the impact of cyberattacks on critical infrastructure (56%), and the loss of business trade secrets or competitive information (55%). It is estimated that governments worldwide could lose more than US$50 billion to deal with the costs associated with malware on pirated software.

Microsoft reminds buyers and retailers to ensure they obtain their software products only from trusted vendors and local authorised sources. To guard against the unintentional purchase and use of counterfeit software and to find out how to verify the origin of Microsoft products, consumers can visit this Microsoft website.