- \n
- Forensic and investigative activities<\/li>\n
- Assessment and auditing services<\/li>\n<\/ul>\n<\/li>\n
- Notification – costs associated with notifying data subjects, regulators, and other third parties\n
- \n
- Emails, letters, outbound calls, or general notice to data subjects<\/li>\n
- Determination of regulatory requirements and communication with regulators<\/li>\n<\/ul>\n<\/li>\n
- Lost business –\u00a0costs associated with loss of customers, business disruptions and revenue lost\n
- \n
- Business disruption and revenue losses from system downtime<\/li>\n
- Cost of lost customers and acquiring new customers<\/li>\n
- Loss of reputation<\/li>\n<\/ul>\n<\/li>\n
- Post-breach response –\u00a0costs associated with helping victims of a breach\n
- \n
- Legal expenditures<\/li>\n
- Regulatory fines<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Out of these four categories, “lost business continued to represent the largest share of data breach costs for the seventh year in a row”, comprising of 38% of the average total cost ($1.59 million). “The second most costly was detection and escalation costs, which had an average total cost of $1.24 million, or 29% of the total cost.” To review all costs outlined by IBM, you can download the full report here<\/a>.<\/p>\n
Which industries are most vulnerable to a costly data breach?<\/h2>\n
While any business that holds data could be at risk of a data breach, certain industries are more vulnerable to attacks. According to IBM, “healthcare was the top industry in average total cost for the eleventh year in a row.” They outlined the top five industries with the highest average total costs:<\/p>\n
- \n
- Health care<\/li>\n
- Financial<\/li>\n
- Pharmaceuticals<\/li>\n
- Technology<\/li>\n
- Energy<\/li>\n<\/ul>\n
It’s worth noting that while the industries above saw the highest average cost, several other sectors experienced large increases to their average total cost involved with a data breach. IBM identify these as:<\/p>\n
- \n
- Services (7.8% increase)<\/li>\n
- Communications (20.3% increase)<\/li>\n
- Consumer (42.9% increase)<\/li>\n
- Retail (62.7% increase)<\/li>\n
- Media (92.1% increase)<\/li>\n
- Hospitality (76.2% increase)<\/li>\n
- Public sector (78.7% increase)<\/li>\n<\/ul>\n
What are the 4 most significant threats facing businesses?<\/h2>\n
With hackers advancing their techniques, there are many more threats facing businesses today. Depending on the type of attack vector, or specific path\/method exploited, you may encounter different costs to resolve the breach.<\/p>\n
According to IBM, the most common initial attack vectors in 2021 are:<\/p>\n
- \n
- Compromised credentials (accounted for 20% of breaches)<\/li>\n
- Phishing (accounted for 17% of breaches)<\/li>\n
- Cloud misconfiguration (accounted for 15% of breaches)<\/li>\n
- Business email compromise (accounted for 5% of breaches)<\/li>\n<\/ol>\n
Interestingly, while business email compromise was responsible for only 4% of breaches, this attack had the highest average total cost associated with it, at $5.01 million.<\/p>\n
According to the report, the highest average total cost of data breaches by initial attack vectors in 2021 are:<\/p>\n
- \n
- Business email compromise ($5.01 million)<\/li>\n
- Phishing ($4.61 million)<\/li>\n
- Malicious Insiders ($4.61 million)<\/li>\n
- Social engineering ($4.47 million)<\/li>\n
- Compromised Credentials ($4.37 million)<\/li>\n<\/ul>\n
“The top four initial attack vectors were the same in 2021 as compared to the 2020 study, but slightly re-ordered. Phishing moved up from fourth to second most common, and cloud misconfiguration fell from second to third-most common.”<\/p>\n
How can small businesses prevent cyber attacks?<\/h2>\n
It is your responsibility as a business to protect your data and train your staff to understand their role in securing data and information. The best way to protect your business is to improve your current security systems and review what processes you have in place. One of the most straightforward ways of doing this would be through performing a GAP analysis.<\/p>\n
Businesses serious about committing to a cyber-secure environment should incorporate an information security management system (ISMS). This decision helps your company manage security threats by giving you the necessary processes and controls to protect your data and information. Management systems are not new and have been used to solve a multitude of business problems. ISO\/IEC 27001<\/a> is considered the gold standard for security frameworks and serves as the ultimate benchmark for businesses to establish, implement, operate, monitor, review, maintain and continually improve their ISMS.<\/p>\n
If you’d like to discuss your business needs and find out if ISO\/IEC 27001<\/a> would suit your company, our experts are here to answer all of your questions.<\/p>\n
![\"Information](\"https:\/\/no-cache.hubspot.com\/cta\/default\/3038466\/13d60104-ef1b-4a92-81fc-433f310be80c.png\")
<\/a><\/span>