Data Breaches Cost India Inc. Rs. 53.5 Mn: Symantec

Symantec Corp. has announced the results of the first annual Cost of a Data Breach Study among Indian organisations. The benchmark study, conducted by Ponemon Institute in partnership with Symantec, found data breaches have serious, quantifiable consequences. The average total cost of a breach to an organisation was INR 53.5 million (5.35 crore), with malicious breaches by hackers or criminal insiders being the most expensive type at INR 4,224 for one compromised record.

“The value of data has never been greater, especially with organisations rapidly adopting new technologies to provide access to business information anywhere, at any time,” Anand Naik, MD - sales, India and SAARC, Symantec. “On the other hand, the economic impact of a data breach is immense and necessitates C-level involvement, and adequate information protection policies and practices.”

Data Breaches Have Quantifiable Direct and Indirect Consequences The study revealed that on average, it costs Indian organisations INR 2,105 for each lost or stolen record, with the average total organisational cost of a data breach being INR 53.5 million (5.35 crore). Costs incurred in notifying customers or the victims were the smallest component – INR 1.56 million (15.6 lakh) on average. In addition, costs incurred by victims to detect and escalate, and redress the data breach formed a significant component of the total average cost, averaging INR 16.4 million (1.64 crore) and INR 20.9 million (2.09 crore) respectively. Victims lost INR 14.6 million (1.46 crore) on average in lost business costs, suggesting that customers abandon the organisation after a breach and rebuilding loyalty or maintaining reputation can be expensive.

Malicious/ Criminal Attacks Cause Most Expensive Breaches

Over a third of victims (35 percent) experienced data breaches due to negligent insiders whose carelessness causes breaches. However, a smaller percentage (20 percent) experienced the most expensive cause of a data breach - hacking or malicious insider breaches, with organisations incurring a cost of INR 4,224 for every compromised record. Victims of malicious attacks experienced criminal insider breaches (75 percent) and theft of data bearing devices (50 percent).

Information Protection Best Practices Can Reduce Costs

Twenty-five percent of participating organisations have centralised the management of data protection with the appointment of a C-level security professional. The study found that organisations with a c-level security professional had an average per capita cost 46 percent less than organisations that do not have a c-level security professional.

The following best practices can help organisations better protect their confidential information and prevent data breaches:

• Assess risks by identifying and classifying confidential information

• Adopt a strategic approach by deploying technologies such as Data loss prevention technologies which enable policy compliance and enforcement

• Implement Two Factor authentication

• Proactively encrypt laptops to minimise consequences of a lost device

• Educate employees on information protection policies and procedures, then hold them accountable

• Implement an integrated security solution that includes reputation-based security, proactive threat protection, firewall and intrusion prevention in order to keep malware off endpoints

• Integrate information protection practices into businesses processes