If you need to understand property crime in the US, visit the Federal Bureau of Investigation’s website. Its Uniform Crime Report will tell you how many offenses were committed nationally in 2011 (9,063,173) and of what type (burglary 24%, larceny 68% and motor vehicle theft 7.9%). It will also give you an estimate of how much property crime cost the US economy that year ($15.6bn).
How about automobile accidents? The US Census and the Department of Transportation (DOT) keep detailed data on their number, type and cause. And the Centers for Disease Control and Prevention, using DOT data and the agency’s own surveys, estimate their total cost was $100bn in 2010, including medical expenses and injury-related productivity losses.
However, ask about the direct or “hard” costs of cybercrime to the US economy, specific states or even individual industries or companies and you get no straight answers.
A survey of 56 companies by Ponemon Institute, a security research firm, sponsored by technology giant HP, put the average annualised cost of cybercrime in 2012 at $8.9m per company. Symantec, a security firm, surveyed 13,000 adults in 24 countries and estimated the global consumer cybercrime problem cost $110bn in 2012. Both numbers pale in comparison to the $1trn price tag that Symantec’s competitor, McAfee, put on the global cybercrime problem back in 2009. That figure made headlines and appeared in a speech by US President Barack Obama, despite questions about its merit.
The truth is that we cannot say with any accuracy how many cybercrime incidents occur each year, who they affect or how much they cost our society or economy. Why has it been so difficult to get our arms around the problem? What is the best way to estimate the direct costs of cyber incidents to organisations? The Economist Intelligence Unit consulted experts on the topic to get their views.
A lack of reliable data hampers cybercrime cost estimates
Existing estimates of the hard costs of cybercrime are unreliable for many reasons, experts say. The most commonly cited reason is limited reporting of cybercrimes by victims, who often lack full information about what occurred. Without comprehensive, representative data from victim organisations across industries and geographies, reliable estimates of costs are difficult to pin down.
The US government collects information on cybercrime and cyber espionage through law enforcement investigations, cyber information-sharing programs, incident-reporting processes, and cyber-warning and analytical capabilities, according to Gregory Wilshusen, director of information-security issues at the Government Accounting Office (GAO). Yet though it has this hard data, it does not publish research on costs. (A single 2007 GAO report (GAO-07-705) cites a 2005 FBI survey putting the cost of computer crime in the US at $67bn.)
Companies that suffer cyber incidents are generally not required to report them. Often, victims do not even know they have been breached. “There are a huge number of incidents that tend not to be discovered,” says Eugene Spafford, a professor of computer science at Purdue University. “And even of those that are discovered, it isn’t always the case that the parties involved know the extent of the incident.”
Even when disclosure is required by law, compliance may be spotty. Organisations have strong disincentives to report cyber incidents to regulators or the authorities. Disclosure can open companies to civil and criminal penalties as well as shareholder lawsuits. Executives may worry that blood in the water will attract other criminals, hackers and hacktivists, Dr Spafford says. Sony, the Japanese electronics and media giant, experienced this phenomenon when an attack on its PlayStation Network in April 2011 was followed by 20 additional attacks on its properties that year, according to a tally by Attrition.org, a non-profit security information service.
Industry estimates built on shaky foundations
The absence of reliable reporting from victims means that organisations that want to put a price tag on cybercrime have to extrapolate from available data, such as customer or survey data collected by third parties. Too often those third parties have biases and use debatable methods.
The McAfee report that priced cybercrime at $1trn, for example, was based on a Purdue University survey of 1,000 global senior IT decision-makers that the security company sponsored. Respondents estimated an average of $4.6m worth of intellectual property losses in 2008. According to ProPublica, an investigative news outlet, McAfee’s marketing group used the $4.6m average to extrapolate a $4.6 billion price tag for the 1,000 surveyed firms and then further extrapolate a $1trn loss figure for all companies globally.
Some people involved in the underlying research, including Dr Spafford, disavowed the $1trn number, saying it wasn’t supported by the data. Patrick Florer, co-founder and chief technology officer at Risk Centric Security of Dallas, Texas said that building up from averages, as McAfee did, is a common strategy in estimates attached to cybercrime. But the approach creates huge distortions and is frowned upon by most statisticians. McAfee has defended the $1trn figure.
Ponemon Institute’s annual Cost of Cyber Crime Study takes a more disciplined approach, though it is hampered by small sample sizes. Ponemon surveys IT, compliance and information-security practitioners at organisations that have experienced breaches and collects detailed, anonymous data about their costs. It then uses an accounting model called “activity based costing” to calculate both the direct and indirect costs of each incident. Ponemon’s 2012 report put the average per-company cost of cybercrime at $8.9 million per year, based on surveys of 418 employees at 56 organisations, up 6% from 2011’s average of $8.4m per surveyed firm.
To estimate indirect costs, the firm considers items like the cost of hiring additional staff in the wake of a breach, reallocating internal resources and business interruptions from computer systems going offline. While those factors hurt revenue, putting a dollar value on such intangibles is tricky, founder Larry Ponemon concedes.
A study by NetDiligence, a cyber risk assessment firm, takes a more conservative approach. NetDiligence looked at 137 cyber-insurance claims between 2009 and 2011 and arrived at an average cost per incident of $3.7m, compared to Ponemon’s $8.9m, says company president Mark Greisiger. Audit data are generally better than self-reported survey data, but the study still has shortcomings. NetDiligence’s sample is small, the time span covered is long, and it only weighs direct costs borne by insurers.
Another oft-cited study that tries to capture the size of the cybercrime problem is the Verizon Data Breach Investigations Report (DBIR). The report aggregates data from breach investigations conducted by Verizon as well as the US Secret Service, Dutch National High Tech Crime Unit and similar law enforcement agencies in the UK, Australia and other countries. The most recent report covered 621 data breaches in 2012 culled from 47,000 “security incidents” involving the theft of 44m records.
Despite the breadth of data sources it consults, Verizon acknowledges its study provides a sampling of cybercriminal activity and data theft that is not necessarily representative of broad trends. In each of the nine years it has tracked data, the numbers of reported breaches, incidents and lost records have swung wildly.
Though most cost studies of data thefts provide average costs per breach or per record lost, these numbers can be misleading. Small breaches can be very expensive, while large ones can be relatively inexpensive if they are simple and easily addressed. For example, a wave of attacks on Western energy industry firms in 2009 targeted proprietary operations and project-financing information on oil- and gas-field bids and operations. The data taken was not voluminous, but it was extremely valuable—the product of tens- or hundreds of millions of dollars in research-and-development spending. By contrast, millions of stolen credit card numbers might be worth mere thousands of dollars on the black market, given that the numbers become worthless once the credit card company becomes aware of the breach.
Mr Florer of Risk Centric Security has analysed most breaches disclosed publicly during the last five years by tracking public filings and other sources. His conclusion? There is little consistency; per-record costs can range from $400 to pennies per record to no cost at all.
Organisational costs and return on prevention
So how should organisations estimate the potential costs of cyberattacks and determine what is a sensible investment in prevention? Broad studies can provide some useful guidance about potential costs. But especially in light of their significant shortcomings, organisations must conduct internal risk assessments to understand the potential cost to their business, as well as potential return on investment from preventive measures.
Experts urge organisations to focus on hard costs that are quantifiable and can be tied directly to business risk, rather than dwelling on esoteric attacks and low-probability scenarios.
“When I talk about risk in a serious way, I'm talking about money,” Mr Florer says. “I think that's what it boils down to for most people. The CFO or CEO wants to know: ‘What's our risk?’ ‘What's the exposure?’ ‘What's the range of exposure?’”
That means looking beyond potential insured losses. Insurers only measure the cost of a breach based on the services for which customers are covered, such as forensic investigations, customer notification and support, legal costs and credit-monitoring services, says Mr Greisiger of NetDiligence.
High-quality risk and business-impact assessments identify a firm’s critical physical and IT assets. They also ascertain the most likely targets of attack, expected types of attacks and effective defences against those specific attacks. This approach helpfully steers firms away from using security technology to respond to incidents (“putting out fires”) or to tick compliance boxes, says Will Gragido, a senior manager of threat research intelligence at RSA Netwitness, a unit of EMC.
Organisations need to be able to answer questions like ‘What is our critical data?’ and ‘What is that data worth?’. Once they know the answer to those questions, understanding—and justifying—the cost of protection becomes easier.
Baseline controls, such as firewall and antivirus software to block attacks, as well as patch and log management software to maintain an organisation’s overall security posture, are a starting point for every business typically required by insurance companies and government and industry regulators.
But companies’ defensive paths may diverge from there, since protections designed to, say, secure credit-card data will differ from those needed to safeguard trade secrets. Also, cyberattacks and attackers tend to differ based on industry and, increasingly, organisation and IT environment, Mr Gragido says. “If you’re in the clean-energy business and you’ve produced something revolutionary with regard to wind technology, that’s going to be more attractive for industrial espionage than a hacktivist” looking to make a political statement, he explains. That intellectual property is highly valuable and attackers would likely be sophisticated, so it is reasonable to spend significant sums to protect those assets.
On an encouraging note, Mr Gragido says some of the most effective tools for reducing risk are already inside many organisations. “I would encourage companies to fully explore what they've already purchased,” he says. For instance, using well-established protocols like “user least privilege”, which grants employees access only to the data they need to perform their jobs, hinders attackers’ ability to move laterally within compromised networks. Similarly, many organisations still struggle to apply security patches to software in a timely manner, though these lapses have been clearly linked to many successful cyberattacks.
Ted Julian, chief marketing officer of Co3, which sells a cloud-based service that helps companies prepare for and respond to security incidents, says investments in tools that quickly detect and respond to cyber incidents may be even more important than in those designed to stop breaches. That’s because limiting the damage caused by ongoing attacks can pay real dividends. Also, the patchwork of state, federal and international privacy and breach disclosure laws makes it costly to overlook evidence of a breach, or to ignore a requirement to disclose a break-in.
“As an industry, our response times have been lousy for the most part,” he says. “That has tilted the scales towards needing good security in place. But if your incident response is awesome, and you can know in a day that an incident has occurred and respond to it, that changes things,” he says.
Changes afoot
If the last 20 years have been about companies, governments and regulators learning the hard lessons of cybersecurity, the next 20 may be about bringing cyber risks under control and making them just another risk society has learned to manage.
“State and federal laws have not caught up with cyber risk yet,” Mr Greisiger of NetDiligence says. “There could be a day when the federal government says ‘Whenever you have an attack, you have to report it.’”
Large-scale reporting would greatly improve our understanding of risk and costs. But some new rules already afoot that will expand disclosure may help academics, regulators, organisations and underwriters better understand the dimensions of the cybersecurity problem.
In the US, the Securities and Exchange Commission in October 2011 issued guidance to public companies requiring disclosure of risks posed by actual or potential cyberattacks under existing risk-factor-disclosure rules, if they “are among the most significant factors that make an investment in the company speculative or risky”.
Two Obama Administration actions in February 2013 —the Presidential Policy Directive 21 on Critical Infrastructure Security and Resilience and an executive order on “Improving Critical Infrastructure Cybersecurity”—contain provisions that could lead to better sharing of cyber threat and incident information, says Mr Wilshusen of the GAO. The Department of Homeland Security is also encouraging more detailed disclosure of incidents and threats by expanding the National Cybersecurity and Communications Integration Center, he says.
In the UK, the government published guidance to senior business leaders in October, including advice on cyber risk management for corporate boards and a list of “10 Steps to Cybersecurity.” Private insurers are using that kind of guidance, and their own data and experience in cyber risk management to help customers address the challenge, says Dr Marie Gemma Dequae, an advisor to the Federation of European Risk Management Associations (FERMA).
Meanwhile, the European Commission’s (EC) Proposed Directive on Network and Information Security will greatly expand the list of companies that are required to disclose breaches and other adverse cyber events, she says. The new directive, which must be approved by the EC and the European Parliament, will expand mandatory cyber incident disclosure laws, which now apply only to telecommunications firms, to a wide swath of critical-infrastructure providers, including “key Internet companies” like social networks, cloud services and e-commerce firms; banking and financial-services companies; and firms in sectors like energy, transportation, health and public administration.
Reducing a problem as complex as cybercrime to a single number, especially for economies as big as the US or EU, may be overly ambitious, Dr Spafford says. Clearly, doing so would first require considerable work to better understand the many costs to victims—an ambitious task itself, considering wildly differing expenses and opportunity costs based on industry, type of cyberattack and harm done. He recommends focusing on thoroughly understanding the size of the threat and costs to organisations in one small sector of the economy, and then expanding to other sectors over time. “The best way to eat an elephant is in small bites,” he says.
