Credit: Dreamstime
The average cost of a security breach has increased to $2.71 million per organisation across ASEAN, with the time taken to identify and contain an attack rising to 287 days.
That’s according to new IBM Security findings, which highlights heightened financial challenges for exposed businesses in Southeast Asia, up from $2.62 million and 259 days respectively in 2019. From a sector standpoint, financial services represents the mostly costly industry for breaches at a regional level.
In comparison, the financial impact stands globally at $3.86 million per breach on average, with employee accounts cited as the “most expensive root cause” involving 80 per cent of incidents.
Commissioned by IBM Security and conducted by the Ponemon Institute, the 2020 Cost of a Data Breach Report is based on in-depth interviews with more than 3,200 security professional in organisations that suffered a data breach during the past 12 months.
Stolen or compromised credentials and cloud misconfigurations are ranked as the most common causes of a malicious breach for companies, representing nearly 40 per cent of incidents.
Delving deeper, attackers used such cloud misconfigurations to breach networks nearly 20 per cent of the time, increasing costs by more than half a million dollars to $4.41 million on average.
At the larger end of the market, breaches wherein over 50 million records were compromised saw costs jump to $392 million from $388 million the previous year. Meanwhile, breaches where 40 to 50 million records were exposed cost companies $364 million on average, increasing $19 million within the space of 12 months.
According to findings, companies who deployed security automation technologies - such as artificial intelligence, automation and analytics - experienced less than half the data breach costs compared to those who didn’t have these tools deployed, ranking at $2.45 million vs. $6.03 million on average.
“When it comes to businesses’ ability to mitigate the impact of a data breach, we’re beginning to see a clear advantage held by companies that have invested in automated technologies,” said Wendi Whitmore, vice president of IBM X-Force Threat Intelligence.
As outlined by Whitmore, the report highlights the “growing divide” in breach costs between businesses implementing advanced security technologies and those lagging behind, revealing a cost-saving difference of $3.58 million. The cost gap has grown by $2 million, from a difference of $1.55 million in 2018.
“At a time when businesses are expanding their digital footprint at an accelerated pace and security industry’s talent shortage persists, teams can be overwhelmed securing more devices, systems and data,” Whitmore added. “Security automation can help resolve this burden, not only enabling a faster breach response but a significantly more cost-efficient one as well.”
State-sponsored attacks
Despite representing just 13 per cent of malicious breaches studied, state-sponsored threat actors are viewed as the most damaging type of adversary in 2020, suggesting that financially motivated attacks (53 per cent) don’t translate into higher financial losses for businesses.
Case in point being the recent unveiling of a five-year cyber espionage campaign targeting government agencies and owned businesses across Southeast Asia, following the re-emergence of hacker group Naikon.
According to Check Point findings, the advanced persistent threat (APT) specialists are “persistently targeting” countries in the same geographical region, which includes Indonesia, Philippines, Vietnam, Thailand, Myanmar and Brunei.
In addition to Australia-based attacks, the group directly targets government ministries of foreign affairs, science and technology, as well as government-owned companies with the alleged motive of gathering of geo-political intelligence.
First revealed in 2015, the group was responsible for attacks against top-level government agencies and related organisations in countries around the South China Sea, in search of political intelligence. Naikon then slipped off the radar, with no new evidence or reports of activities found until now.
“The highly tactical nature, longevity and stealth manoeuvres of state-backed attacks, as well as the high value data targeted, often result in a more extensive compromise of victim environments, increasing breach costs to an average $4.43 million,” the report added.
