The escalating economic impact of cyber crime

Source: HP infographic.

HP has unveiled the results from its sixth annual study in partnership with the Ponemon Institute detailing the economic impact of cyber attacks across both the private and public sectors. 

The findings reveal a dramatic increase in the overall cost of cyber crime, and reveal that small organisations incur a significantly higher per capita cost than larger organisations³.

Conducted by the Ponemon Institute and sponsored by HP Enterprise Security, the 2015 Cost of Cyber Crime Study quantifies the annual cost of cyber crime for companies across seven countries: the US, UK, Japan, Germany, Australia, Brazil and the Russian Federation.

In the study, researchers found the average annualised cost of cyber crime incurred by a benchmark sample of Australian and Japanese organisations had increased by 13% and 14% respectively since last year. The results also revealed that it took an average of 31 days to resolve a cyber attack in Australia as compared to 26 days in Japan^{1, 2}.

“As organisations increasingly invest in new technologies like mobile, cloud, and the Internet of Things, the attack surface for more sophisticated adversaries continues to expand,” said Matthew Shriner, Director, Enterprise Security Products, Asia Pacific and Japan, and Europe, Middle East and Africa, HP. “To address this challenging dynamic, we must first understand the threats that pose the most risk and then prioritise the security strategies that can make a difference in minimising the impact.”

Key findings from the 2015 Australia and Japan Cost of Cyber Crime Studies:

· Cyber crimes continue to be very costly: The average annualised cost of cyber crime incurred in Japan was US$6.81 million, compared to US$3.47 million in Australia^{1, 2}.

· Cyber crimes require more time to resolve: The average time to resolve a cyber attack was 31 days in Australia, compared to 26 days in Japan. This represents an increase of eight days in Australia and one day in Japan over the last year. Results also showed that malicious insider attacks can take an average of 50 days to contain in Australia, compared to 37 days in Japan^{1, 2}.

Understanding the cyber threats that pose the biggest risk and have the most economic impact to organizations can help enterprises better plan their security approach and investments.

· In both Japan and Australia, the most costly cyber crimes continued to be caused by denial of service and malicious insiders^{1, 2}.

· In Australia, business disruption continued to represent the highest external cost, followed by the costs associated with information loss. On an annual basis, business disruption accounted for 38% of total external costs¹.

· In Japan, information theft represented the highest external cost, followed by the costs associated with business disruption. On an annual basis, information theft accounted for 48% of total external costs².

· Recovery and detection were the most costly internal activities in both countries. Australia reported that it accounted for 48% while Japan reported it accounted for 53% of the total annual internal activity cost. In both countries, productivity, cash outlays and direct labour represented the majority of these costs^{1, 2}.

Organisations investing in and using security intelligence technologies and governance practices to address the crimes that proved most costly were more efficient in detecting and containing cyber attacks, thereby reducing costs otherwise incurred¹.

· Deploying a security information and event management (SIEM) solution led to an average cost savings of US$1.9 million per year³, compared to companies not deploying similar security solutions.

· Employment of certified/expert security personnel trigger savings of US$1.5 million³.

· The appointment of a high-level security leader can reduce costs by US$1.3 million³.

“With cyber attacks growing in both frequency and severity, understanding of the financial impact can help organisations determine the appropriate amount of investment and resources needed to prevent or mitigate the consequences of an attack,” said Dr Larry Ponemon, chairman and founder, Ponemon Institute. “As seen in this year’s study, the return on investment for organisations deploying security intelligence systems, such as SIEM, realised an average annual cost savings of nearly US$4 million – showcasing the ability to minimise impact by more efficiently detecting and containing cyber attacks.”

Across all seven countries studied, the US sample reported the highest total average cost of cyber crime at US$15 million per company. The Japan sample ranked third globally at US$6.81 million while the Australia sample ranked second lowest out of seven countries, reporting an average cost of cyber crime at US$3.47 million³.

Interested?

Hear more detail on the Cost of Cyber Crime Study’s findings and how actionable security intelligence can help to minimise the impact of cyber crime through a webcast being held Wednesday, October 14 at 12 pm EDT (12am October 15 Singapore time). 

Find out more about the country-specific findings of the Cost of Cyber Crime Study or copies of the full reports, along with an interactive assessment tool

View the associated infographic

1 2015 Cost of Cyber Crime Study: Australia, Ponemon Institute, September 2015.
2 2015 Cost of Cyber Crime Study: Japan, Ponemon Institute, October 2015.
3 2015 Cost of Cyber Crime Study: Global, Ponemon Institute, October 2015.
4 2014 Cost of Cyber Crime Study: Australia, Ponemon Institute, October 2014.
5 2014 Cost of Cyber Crime Study: Japan, Ponemon Institute, October 2014.

Beware, Superman is toxic

Superman is a huge online threat. That's what McAfee says in a blog post. The ubiquity of superheroes outside of the comic books means that hackers and scammers can use them for cybercrime, the company said.

The company has released survey results for the Most Toxic Superheroes using McAfee SiteAdvisor site ratings, and the Man of Steel topped the list. The study determined that searching 'Superman', 'Superman and free torrent download', 'Superman and watch', 'Superman and free app', and 'Superman and online', yields a 16.5% chance of landing on a website that has tested positive for online threats, such as spyware, adware, spam, phishing, viruses and other malware.

Other superheroes also yield high chances of falling victim to malware, including Thor, WonderWoman, Azuaman, and Wolverine. 

McAfee recommends the following to stay safe: 

Be suspicious: If a search turns up a link to free content or too-good-to-be-true offers, be wary

Double-check the web address: Look for misspellings or other clues that the site you are going to may not be safe (for more on this, read the McAfee blog on typosquatting)

Search safely: Use a web safety advisor, such as McAfee SiteAdvisor that displays a red, yellow, or green ratings in search results, alerting you to potential risky sites before you click on them

Protect yourself: Use comprehensive security software on all your devices, like McAfee LiveSafe service, to protect yourself against the latest threats

Checking out Ronaldo? Think twice

According to research from McAfee, part of Intel Security, cybercriminals are most likely to use popular Portuguese footballer Cristiano Ronaldo's name to lure visitors to web pages designed to infect them with malware. The McAfee “Red Card Club” showcases the top eleven Brazil-bound players whose web pages are considered to be risky for fans to search for online. Following Ronaldo are Argentina’s Lionel Messi, Spain’s Iker Cassillas, Brazil’s Neymar and Algeria’s Karim Ziani.

Source: McAfee

Cybercriminals are likely to leverage consumer interest in the world’s most popular sport to lure victims to websites rigged with malware, malicious code capable of infecting a user’s machine and stealing passwords and personal information. McAfee researchers have used McAfee SiteAdvisor site ratings to determine which sites are risky to search when coupled with footballer names, and have calculated an overall risk percentage for each.

According to the research, fans run the greatest risk when visiting sites offering screensaver downloads and videos showcasing the extraordinary skills of the players. Searching for the latest Cristiano Ronaldo content yields more than a 3.7% chance of landing on a website that has tested positive for online threats, such as spyware, adware, spam, phishing, viruses and other malware.  

Players make the McAfee “Red Card Club” by scoring among the top eleven positions in terms of greatest probability by percentage of web page risk.

“Red Card Club” Rank	Player	Country	Risk %
1	Cristiano Ronaldo	Portugal	3.76%
2	Lionel Messi	Argentina	3.72%
3	Iker Casillas	Spain	3.34%
4	Neymar	Brazil	3.14%
5	Karim Ziani	Algeria	3.00%
6	Karim Benzema	France	2.97%
7	Paulinho	Brazil	2.81%
8	Edinson Cavani	Uruguay	2.67%
9	Fernando Torres	Spain	2.65%
10	Eden Hazard	Belgium	2.50%
11	Gerard Piqué	Spain	2.45%

“We want to caution consumers through the McAfee “Red Card Club” to not to let their guard down as they join in all the excitement surrounding the World Cup online. Be especially wary of videos promising to show your idol’s skills as you might get more than you bargain for,” said David Freer, Vice President, Consumer – APAC at McAfee. "Cybercriminals will definitely try to capitalise on ‘World Cup fever’, so it’s wise not to be complacent by downloading content that might put you at risk.”

Tips to Stay Protected

To avoid the summertime blues of becoming infected during the Brazil games and beyond, McAfee suggests:

Beware of content that prompts you to download anything before providing you the content. Opt to watch streaming videos or download content from official websites of content providers.

• “Free downloads” are the highest virus-prone search term. Anyone searching for videos or files to download should be careful to not unleash malware on their computer.
  
• Established news sites may not entice you with exclusives for one solid reason: there usually aren’t any. Stick to official news sites that you trust for breaking news. However, trusted sites can also fall prey to hackers. Make sure to use a safe search tool that will notify you of risky sites or links before you visit them. A complimentary version of McAfee's SiteAdvisor software can be downloaded at www.siteadvisor.com.
  
• Don’t download videos from suspect sites. The useful news can typically be found on official video sites, and don’t require users to download anything. If a website offers an exclusive video for you to download, don’t.
  
• Don’t 'log in' or provide other information: If you receive a message, text or email or visit a third-party website that asks for your information—credit card, email, home address, Facebook login, or other information—for access to an exclusive story, don’t give it out. Such requests are a common tactic for phishing that could lead to identity theft.
  
• If you do decide to search for information on a major event or celebrity in the news, make sure your entire household’s devices have protection, such as McAfee LiveSafe which protects all devices including PCs, Macs, tablets and smartphone and it also includes malware detection software; and McAfee Mobile Security to protect your smartphone or tablet from all types of malware.
• Always use password protection on your phone and other mobile devices. If your phone is lost or stolen, anyone who picks up the device could publish your information online.