Insider incidents and high-profile crimes increasing
The number of reported security incidents rose 48 percent this year to 42.8 million – which is the equivalent of 117,339 attacks per day. A report from PwC US, CIO and CSO magazines, also indicates that the compound annual growth rate (CAGR) of detected security incidents has increased 66 percent year over year since 2009.
As security incidents grow in frequency, the associated costs of managing and mitigating breaches are also increasing. Globally, the estimated reported average financial loss from cybersecurity incidents was $2.7 million – a 34 percent increase over 2013.
Big losses have been more common this year as organizations reporting financial hits in excess of $20 million rose 92 percent. While risk has become universal, the survey found that financial losses also vary widely by organizational size.
Despite elevated concerns, the survey found that global information security budgets actually decreased four percent when compared with 2013. In fact, security spending as a percentage of IT budget has remained stalled at 4 percent or less for the past five years.
“Strategic security spending demands that businesses identify and invest in cybersecurity practices that are most relevant to today’s advanced attacks,” explained Mark Lobel, PwC Advisory principal focused on information security. “It’s critical to fund processes that fully integrate predictive, preventive, detective and incident-response capabilities to minimize the impact of these incidents.”
Organizations of all sizes and industries are aware of the serious risks involved with cybersecurity; however, larger companies detect more incidents. Large organizations – with gross annual revenues of $1 billion or more – detected 44 percent more incidents this year. Comparatively, medium-sized organizations – with revenues of $100 million to $1 billion – witnessed a 64 percent increase in the number of incidents detected.
Insiders have become the most-cited culprits of cybercrime – but in many cases, they unwittingly compromise data through loss of mobile devices or targeted phishing schemes. Respondents said incidents caused by current employees increased 10 percent, while those attributed to current and former service providers, consultants and contractors rose 15 percent and 17 percent, respectively.
Meanwhile, high profile attacks by nation-states, organized crime and competitors are among the least frequent incidents, yet are among the fastest-growing cyber threats. This year, respondents who reported a compromise by nation-states increased 86 percent – and these incidents are also most likely under-reported. The survey also found a striking 64 percent increase in security incidents attributed to competitors, some of whom may be backed by nation-states.
Effective security awareness requires top-down commitment and communication, a tactic that the survey finds is often lacking across organizations. Only 49 percent of respondents say their organization has a cross-organization team that regularly convenes to discuss, coordinate, and communicate information security issues.
PwC notes that it is critical for companies to focus on rapid detection of security intrusions and having an effective, timely response. Given today’s interconnected business ecosystem, it is just as important to establish policies and processes regarding third parties that interact with the business.