Technology & Innovation

What's the damage?

March 31, 2014

Africa

March 31, 2014

Africa
Riva Richmond

Former editor

Riva Richmond is Director of Digital Media at The Story Exchange, a nonprofit digital media project that tells the stories of women entrepreneurs in articles and videos. Previously she worked as a Senior Editor with The Economist Intelligence Unit's Thought Leadership team in New York. She has reported and written about technology more than a decade, much of that time focused on information security and privacy issues. Prior to her current position, Riva was a freelance journalist writing for The New York Times, Entrepreneur.com, The Wall Street Journal and other national publications.

Contact

How much money do cyberattacks cost companies, economies, society? It seems safe to say that the financial fallout is severe and growing worse, but the details are all too murky.

How much money do cyberattacks cost companies, economies, society? It seems safe to say that the financial fallout is severe and growing worse, but the details are all too murky.

We do know that most companies are being attacked—and attacked relentlessly. Three-quarters of organisations have suffered an incident in the last two years, according to a March 2014 report from The Economist Intelligence Unit, and the frequency of incidents is on the rise. And we know that individual breaches can be extraordinarily costly; Target, the US retailer, said in late February that a massive breach of customer data cost the company US$61m in response costs in the fourth quarter alone and helped fuel a 5.5% drop in transactions during the crucial holiday shopping season.

Yet the complexity of assessing the “hard” and “soft” costs of cyberattacks means that making quality cost estimates of specific incidents is tricky at best. And deep corporate fear of disclosing incidents and their consequences has created a culture of secrecy. As a result, most of the statistics we have offer limited insight into the true size and shape of the financial burden we are all bearing.

Of course, it is difficult to address a problem effectively if you don’t understand its size and scope. In an effort to improve this situation, the EIU has developed a digital tool called CyberTab, underwritten by Booz Allen Hamilton.

CyberTab is a calculator that helps executives understand the financial penalties and business risks imposed on companies by specific cyberattacks—and run cost/benefit analyses around security spending.

Users are asked to input estimates for items like incident-response and business expenses, lost sales and the value of lost customers, either for a potential attack scenario or for an actual attack their company has experienced. Then CyberTab provides a downloadable report that explains the cost of the attack and an estimated "return on prevention"—the sum their company would have saved, had it invested in tools, resources or controls that would have prevented or quickly stopped the attack.

But CyberTab is also a survey tool that collects anonymous, encrypted data that will enable the EIU to shed light on cost trends, industry-specific challenges and the larger impact on our economy and society as a whole. It only collects data from users who opt-in, and it does not gather information that identifies executives or companies.

In the service of this larger goal, we urge executives who use CyberTab to contribute the data they enter into the calculator to the EIU’s research project. We plan to publish industry reports in the next phase of this research programme—and to add benchmarking functionality to CyberTab, so executives who submit data can see how they compare with their peers.

Good intelligence is vital to a good defence. Be part of the solution. Participate in our research.

 

The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week