Transcript 0:01 Think about that. Orchestration, automation, and response. There are so many great tools at our disposal today. 0:09 The real question is whether we're going to invest in them, whether you understand about making the investment, and are they going to stop an attack? Possibly not. Probably not. 0:22 But they are going to lessen the impact of the attack. Maybe that's the point. 0:29 [upbeat music] Welcome to The Peggy Smedley Show, your voice for our connected world, with your host, Peggy Smedley. 0:47 Hello, listeners, and welcome to today's edition of The Peggy Smedley Show. I'm your host, Peggy Smedley. Today on The Peggy Smedley Show, I'm gonna be taking a look at data breaches and talking all about them. 0:58 Has your company had a data breach? How much has it cost your organization? The average cost of a data breach just might surprise you. 1:07 If your company has had a data breach, how does your numbers compare to other organizations? If you are in one particular vertical, your numbers are likely much higher than others. 1:19 I will share that here on the first segment. As well, has your company mitigated the risks of the rising cost of data breaches? If your company has not had a data breach, your company is definitely in the minority. 1:34 Today, since a new report is out on the cost of data breaches, I will be digging into this topic in great detail. 1:41 There is actually a lot to discuss, so stick around the entire first segment as we dive into this very important topic. Later on in the show, I'll be interviewing some really great guests as always. 1:53 I'll be talking to Peter Corte, who is the chief strategy officer and chief technology officer at Siemens, and then I will wrap up the show welcoming back Anne Munaretto, who's the partner in sustainability services at Ernst & Young. 2:10 So stick around. We've got a lot to talk about, but let's get started. First, let me give you a bit of background about this report. The cost of a data breach report is now in its seventeenth year. 2:23 It is conducted independently by the Ponemon Institute and published by IBM Security. 2:30 The research studies five hundred and fifty organizations impacted by data breaches that occurred between March twenty twenty-one and March twenty twenty-two across seventeen countries and seventeen different industries. 2:45 Now, here's what it found. The average cost of a data breach averaged four point three five million dollars, which is an all-time high. 2:55 The average cost has soared almost thirteen percent to a whopping twelve point seven percent from twenty twenty-two. 3:04 Which vertical markets are most susceptible to a risk, seeing a data breach or, you know, maybe another hack? Critical infrastructure organizations are typically hit the hardest. 3:16 This includes organizations in financial services, industrial, technology, energy, transportation, communication, healthcare, education, and the public sector industries. 3:29 The average cost of a data breach for a critical infrastructure organization specifically is estimated at about four point eight two million dollars, which is more than the average cost for, for organizations in other industries. 3:46 Twenty-eight percent of critical infrastructure organizations experienced a destructive or ransomware attack. Seventeen percent experienced a breach because of a business partner being compromised. 4:02 Now, let's talk a little bit more about how these breaches are happening across all vertical markets. Nineteen percent of breaches are caused by stolen or compromised credentials. 4:14 This is the most common cause of a data breach. 4:18 Breaches caused by stolen or compromised credentials had an average cost of four and a half, or, you know, four point five bil- million, million, I should say, million dollars. Now think about that. 4:30 Millions of dollars are stolen. These breaches also had the longest life cycle. It took two hundred and forty-three days to identify the breach and another eighty-four days to contain the breach. 4:46 Now, think about if that was happening at your company. The second most common cause of a breach, you guessed it, is phishing by sixteen percent. 4:57 This was the most costy, costliest I should say, averaging four point nine one million in breach cost. Some of the other factors I think we need to note are forty-five percent of breaches occurred in the cloud. 5:15 Found that interesting, right? So did I. And if remote work is involved, costs were on average a million dollars greater than breaches were for remote working wasn't a factor, where remote working wasn't a factor. 5:30 So let me state that again. If remote work is involved, costs were on average a million dollars greater than breaches where remote working wasn't a factor. So we need to think about that. 5:43 There are just a few things to consider when looking at breached and ransomware, because this is kind of interesting. But let's talk about the available solutions. Zero trust. 5:56 Could zero trust be a good option for organizations? Maybe41% of organizations in the study said they deploy a zero trust security architecture. 6:09 Now interestingly, 59% of organizations that don't deploy zero trust incur an average of a million dollars in greater breach costs compared to those that do deploy. 6:23 But perhaps one of the greatest solutions comes in the form of deploying security AI and automation. 6:31 Breaches at organizations with this technology cost $3.05 million less than breaches at organizations with no solutions deployed. This is a 65, 6:47 little over 65% difference in average breach costs, and it represents the largest cost savings in the study. This certainly makes you think, doesn't it? 7:00 Companies with fully deployed security in AI and automation also experience an average of a 74-day shorter time to identify and contain the breach than those without security AI and automation. 7:17 Also, the use of technology jumped from 59% in 2020 to 70% in 2022. Okay, so let's think about this. So here's my opinion for today. 7:30 While there are no guaranteed ways to prevent a data breach from happening, there are absolutely steps we can take to mitigate the risk. Let's get to it. Technology. Yes, we know it, technology. 7:45 There are technologies that can help reduce the cost of the breach and the timeframe to identify the breach. How many times have we said this before? I feel like I'm a broken record. 7:54 Okay, a broken whatever, but you get it. Zero to... Okay, vinyl. We won't say record. Vinyl, whatever. A zero trust security model can help. A fully deployed security AI and automation can also lend strong defense. 8:12 If you are in a cloud environment, consider protecting data using policy and encryption. Use tools to protect and monitor endpoints and remote employees. We know this. We, we talk about this all the time. 8:28 It's, it's, it's not science, it's fact. We all need 24/7 protection everywhere, every place. Create and test incident response playbooks to increase cyber resilience. 8:42 Invest in security orchestration, automation, and response. Think about that. Orchestration, automation, and response. There are so many great tools at our disposal today. 8:57 The real question is whether we're going to invest in them, whether you understand about making the investment, and are they going to stop an attack? Possibly not. Probably not. 9:10 But they are going to lessen the impact of the attack. Maybe that's the point. 9:16 Absolutely, they're going to lessen the impact, and perhaps probably even more important- importantly, they're gonna lessen the impact of media talking about your attack to everybody in the rest of the world, like me talking about the attack that I'm telling you right now because you should have known. 9:32 We all know. At this point, that is all we can do, is take the measures to educate our workforce, uh, on the dangers of a data breach, and to put the right tools in place to help lessen the impact. 9:46 That's what we're talking about. There are a lot of bad guys out there. 9:49 There's a lot of bad actors, and they're always looking for ways, phishing, whatever it might be, to just constantly penetrate, penetrate, penetrate your systems. 9:59 We know that, but you've gotta kinda figure out a way to stop it. You're not gonna totally stop it, but maybe ease the pain. I know that sounds terrible, but what leads me to my tip of the week, do something. 10:15 Don't just sit on the sidelines and go, "I'm not gonna do anything." Do something right now to minimize the risk of a data breach. 10:22 That's what we're talking about, especially if your organization works in the critical infrastructure. Oh, my heavens. That's what we don't want, something happening to our critical infrastructure. 10:32 Don't let your organization be, you know, a sitting duck for a major attack. You don't want that. There are so many new solutions becoming available to help minimize the amount of cost associated with a data breach. 10:45 I just gave you all these ridiculous financial numbers and the cost of what's happening. You don't wanna be one of those. We don't want you to be one of those. 10:53 We need to do something now, otherwise those numbers are just gonna keep rising year after year after year, and I'm gonna be the one reporting on them. You don't want that. So this is my challenge to you this week. 11:06 Do your homework. Research it. Get your staff to do their homework. Check out this report and others. This is a great report. 11:13 Learn about the greatest risks in your industry and uncover some of the best solutions to help when a data breach does occur. Perhaps seek out the help of a consultant who can offer advice. 11:24 There's some really super smart consultants out there who can at least advise you on what to do. And if you take the right steps today, you just might be making a $4.5 million decision. 11:37 But you can see, you know, over $4 million we're talking about here. You know? I mean, w- we're talking about a lot of money. 11:44 At the end of the day, an investment in your security system is investment in your future and preventing all of these bad things from happening, or at least minimizing them. All right. 11:56 As always, if you have thoughts on what I've talked about today, please send me a tweet to continue this discussion on social media at Connected World. All right. That's all the time we have for this segment. 12:06 Please check out our website at connectedworld.com, our show website at thepeggySmedleyShow.com, and make sure to share and subscribe to our episodes each week. Don't go away. We're gonna take a quick commercial break. 12:17 This is The Peggy Smedley Show, your voice for our connected world. And remember, with great technology comes great responsibility. We'll be right back.
