Study finds ID and password breaches cost $1.5 million per attack
Phoenix Technologies report looks at federal data theft prosecutions; failure to authenticate computers seeking network access causes majority of breaches; most attacks originate from homes, not on-site users; worm and virus threat may be overrated
The plural of anecdote is not data, so they say, but real numbers about IT security losses are not easy to come by, leaving consumers and security planners uncertain about where their risks truly lie. In designing their own study about the financial impact of stolen IDs and passwords, Phoenix Technologies took a hard-nosed approach: they only looked at cases prosecuted and publicly disclosed by the Department of Justice between March 1999 and February 2006. The value of the liberal (some say oppressive) federal discovery rules are finally becoming apparent.
The report, “Network Attacks: Analysis of Department of Justice Prosecutions 1999-2006,” concludes that the failure of organizations to verify the identity of computers seeking access to their networks was the single biggest factor in security breaches. Seventy-eight percent of such attacks originate from home computers, and eighty-four percent of attacks, the report found, could have been prevented by taking this single step beyond verifying user IDs and passwords. Hackers gained access through a variety of means, including network sniffing, password cracking programs, and collusion with (current and former) company insiders. The average cost of each attack was $1.5 million.
One other interesting finding: “Although viruses and worms did cause the largest amount of total damage, on an aggregated basis, damage was spread across many organizations and countries. The average cost to an individual company from any single virus attack analyzed in this study was surprisingly low, at $2.4 thousand.”
-read more in this Phoenix Technologies report
