The costs and benefits related to cyber security breaches Chapter 3 – Gordon & Loeb

2 Benefits of Cyber Security The benefits of cyber security are “essentially the costs savings associated with prevented cyber security breaches”. So to understand the benefits of cyber security we must be able to quantify the costs associated with any security breaches. We do this by examining the forms and magnitudes of the cyber security breaches and potential impacts of each

3 Costs of Cyber Security Attacks Direct costs  Costs associated with the personnel, hardware, software needed dedicated to preventing, detecting and correcting specific breaches. Indirect costs  Costs that cannot be linked directly to a single attack event.  Includes intrusion detection systems Explicit costs  Costs that can be measured in a specific manner i.e. firewalls, encryption, access controls and other technical activities to assure security, access and data integrity. Implicit costs  Are often opportunity costs such as lost revenues reputation, potential legal liability etc.

4 The Cyber Security Grid and Direct costs Most studies believe that the implicit costs of Cyber security breaches are usually the highest However, in 2004 the Computer Security Institute and the FBI study found that organizations lost over $141 million in direct losses due to Cyber security breaches. Many believe that very few companies actually report any breaches at all. Confidentiality Data availability Data integrity Explicit Costs Implicit Costs Indirect costs Direct costs

5 Approaches to measure impacts of Cyber Security Some studies have looked at the implicit costs of the value of a company on the stock market that has experienced a Cyber security breach. The finding on a study published in Journal of Computer Security in 2003 found that attacks involving confidentiality had an impact on the value of a stock (negative 5%) That is a loss of $5,000,000,000 for a company the size of Wal- Mart or Exxon Mobile.

6 Some findings The authors observe (p65) that: “It is a myth to assume that all Cyber security breaches have a significant economic impact on organizations. The reality is that a large portion of Cyber security breaches does not have an economic impact on organizations” However, confidentiality attacks do have an impact.

7 Your Turn!