From protecting user data against the growing number of threats to ensuring the continuity of the business, IT Security is an essential element in any organization IT infrastructure. As IT professionals being able to benchmark against our peers, assess a threat, or just having some understanding of why a security project is important to the business is key. So I have created this list of 84 important, fascinating and quite honestly in some cases scary statistics and numbers to help you demonstrate the importance of having good security tools and processes in place, and provide you insight into where the next great threat may come.
Security Incidents & Breaches
• 71% were affected by a successful cyberattack in 2014, but only 52% expect to fall victim again in 2015.1
• Security incidents grew 66% CAGR.9
• Europe saw 41% more detected incidents, compared to 2013.9
• Automotive firms report a 32% increase in detected incidents.9
• Security incidents soared 60% in healthcare.9
• Power and utility companies detected 527% more incidents in 2014, over 2013.9
• Technology companies reported 17% fewer security incidents in 2014.9
• 21% of IS professionals report having been subject to an APT attack.6
• 66% of IS professionals feel it is likely that they will be subjected to an APT attack.6
• 12% of US healthcare report that their organization has had at least one known case of medical identity theft reported by a patient in the prior 12 months.5
• 19% of US Healthcare report that they had a security breach in the last year.5
• 25% of respondents reported having either a case of medical identity theft or a security breach in the last 12 months.5
Cost of Security Breaches
• The average cost of a corporate data breach increased 15 percent in the last year to $3.5 million.10
• Security incidents caused downtime of more than 8 hours for 31% of impacted organizations.9
• The involvement of business continuity management reduced the cost of data breach by an average of almost $9 per record.10
• 54% report that electronic crimes by outsiders were more costly or damaging.4
• Each lost or stolen record containing sensitive and confidential information costs a consolidated average of $145.1010
• North America saw a 7% decrease in financial loss attributed to security events.9
• Companies in the U.S. and Germany paid the most at $246 and $215 per compromised record, respectively.10
• Financial services organizations saw the financial losses from incidents jump 24%.9
• The cost of a security breach leapt 282% in healthcare.9
• Companies that said they have a strong security posture were able to reduce the cost by as much as $14 per record.10
IT Security Budgets
• 62% of IT security budgets are expected to rise in 2015.1
• 70% of respondents are spending greater than 5% of their IT budgets on security.1
• The average 2014 information security budget in North America was $4.6M (up from $4.5 in 2013).9
• The average 2014 information security budget in South America was $3.5M (down from $4.6 in 2013).9
• The average 2014 information security budget in Europe was $3.4M (up from $3.0M in 2013).9
• Europe reports a 12% increase in security spending.9
• The average 2014 information security budget in Asia Pacific was $4.5M (down from $5.1M in 2013).9
• Information security represented 6.9% of industrial product companies’ total IT budget.9
Attack Surface & Methods
• When looking at the number of breaches per asset category, servers have typically been on top – that is where the data is stored – but user devices have been growing over time.2
• Mobile devices (smartphones and tablets) are perceived as IT security’s weakest link, closely followed by social media applications.1
• The majority of users (58%) operate 3-4 devices on a daily basis.7
• 59% of respondents experienced an increase in mobile threats over the past year.1
• 66% of sensitive data is stored upon on-site servers.8
• 89% of US healthcare make patient data available to patients, surrogates and/or designated others.5
• 43% of US healthcare share data with patients via a health website or web portal.5
• 92% of IS professionals believe APTs represent a credible threat to national security and economic stability.6
• 92% of IS professionals believe that social network use increases likelihood of a successful APT attack.6
• 88% on IS professionals think that BYOD combined with rooting or jailbreaking makes a successful APT attack more likely.6
• More than 1 in 4 IS professionals believe the highest risk from APTs is loss of personal information of employee or customer.6
• 63% of users admit to forgetting a password, or had a password compromised, in their professional life.7
• 92% of 100,000 analyzed incidents can be categorized by just 9 basic patterns.2
• Countries in the Arabian region and Germany had more data breaches caused by malicious or criminal attacks.10
• India had the most data breaches caused by a system glitch or business process failure.10
Insider Threat
• Insiders / contractors are the most likely perpetrators of security incidents reported in South America.9
• 57% of respondents consider employees the most likely source of an attack.3
• The majority of employees perpetrated their acts while in the office right under the noses of coworkers.2
• 72% of security incidents at financial services organizations involved a current or former employees.9
• Third parties with trusted access were responsible for 41% of the detected security incidents at financial services organizations.9
• 62% of security incidents at industrial product organizations involved a current or former employees.9
• 75% of Insider Intrusions are handled internally – without legal action or law enforcement.4
• Most crimes by trusted parties (insider and privileged users) are perpetrated for financial or personal gain.2
• The two most common insider threat scenarios involve perpetrators taking data to start their own competing company (30%), or to help secure employment with a rival (65%).2
• In US healthcare the top 3 perceived threat motivators were workers snooping on relatives/friends (80%), financial identity theft (66%), and identity theft (51%).5
• Only 23% of respondents are confident their organizations have made adequate investments to monitor the activities of privileged users.1
Corporate Espionage, Activists, Hacktivists & Nation States
• Compromises attributed to competitors were highest in Asia Pacific.9
• Almost half (47%) of respondents from China point to competitors as the source of security incidents, higher than any other nation.9
• Automotive firms saw an 84% increase in security incidents from activists / hacktivists.9
• Attacks by nation-states jumped 80% at technology companies, explaining increase in IP theft perhaps.9
Policies & Procedures
• One in three companies do not have a written information security policy (WISP).8
• 77% of organizations have a password policy or standard.8
• 59% of organizations have a user (privileged) access policy.8
• 46% of organizations have an incidents response policy.8
• 34% of companies do not have a crisis response plan for a data breach or cyberattack event.8
• 49% of companies do not perform periodic “fire drills” to test IT Security event response plans.8
• 54% of US healthcare provider IT & IS professionals have tested their data breach response plan.5
• 1 in 3 organizations do not or do not know if third-party data access contracts / policies are in place.8
• 77% of IS professionals have not updated agreements with third parties for protection against APTs.6
• Less than 40% of organizations conduct full-network active vulnerability scans more than once per quarter.1
• Only 20% of IT security professionals are confident their organizations have made adequate investments in educating users on how to avoid phishing attacks.1
Current IT Security Methods
• On average US healthcare organizations have 11 types of technical security tools in place.5
• Nearly two thirds of organizations do not have well-defined and automated IAM programs.3
• 21% of US healthcare organizations are not using Disaster Recovery technology, of which 51.7% intend to purchase DR in the future.5
• 54% of US healthcare organizations do not have single sign-on implemented, of which 49.3% intend to purchase SSO in the future.5
• 60% of US healthcare organizations do not have two-factor authentication implemented.5
Current & Future Challenges / Concerns
• Phishing, malware, and zero-days give IT security the most headaches.1
• 56% of organizations say it is unlikely or highly unlikely that they would be able to detect a sophisticated attack.3
• Low security awareness among employees continues to be the greatest inhibitor to defending against cyberthreats, followed closely by lack of security budget.1
• Healthcare industry cites access control and identity management for end users as their top challenge.9
• 37% say that real time insight on cyber risk is not available.3
• Attackers are getting better/faster at what they do at a higher rate than defenders are improving their trade.2
• Inadvertent exposure of confidential data is the top concern with SaaS-based file sharing applications.1
• BYOD initiatives are expected to nearly double in the coming year—from 30% to 59% of organizations.1
I am sure many of you are reading this asking what about the number of records breached or what about that study by Gartner or Forrester that stated…. If you have data points of interest do drop it into a comment (with source) and share it with us all. Every bit helps.
Sources
12015 Cyberthreat Defense Report North America & Europe
2Verizon’s 2014 Data Breach Investigations Report
3Get ahead of cybercrime. EY’s Global Information Security Survey 2014
4CERT’s 2014 U.S. State of Cybercrime Survey
56th Annual HIMSS Security Survey
6ISACA 2014 Advanced Persistent Threat Awareness Study
7Password Security Survey Results
8Bridging the Data Security Chasm. Assessing the Results of Protiviti’s 2014 IT Security and Privacy Survey
9The Global State of Information Security Survey 2015, a worldwide study by PwC, CIO, and CSO
10Insurance Journal’s Company Data Breach Now Costs $3.5M on Average
Support
Documentation
Learning Services
Partner Programs
