Industry View

Valuing Your Security and Compliance Investment

By Dr. Murray Mazer, Lumigent

November 26, 2007 — CSO —

Security has been traditionally viewed as a drag on an organization, a cost with no real benefit. Lately, this view is being turned upside down by the disturbingly frequent incidents of data misuse and data thefts being reported. Whereas in the past an organization could have weak controls around their data and suffer quietly in case of a data breach, this is no longer acceptable. Organizations need policies and safeguards to assure compliance, turn policy into practice, reduce the number of harmful incidents, and increase the likelihood that an incident will be detected.

This implies a need to invest in security and compliance, both in people and technology. The issue remains, however, of understanding the benefit that accrues.

First, a look at the downside

Database intrusions and data thefts have been making headlines more and more lately. The now infamous TJX data breach occurred over a period of several years but was just brought to light at the beginning of this year. It has been tagged as the largest data theft to date.

Another Massachusetts-based company, BJ’s Wholesale Club, suffered severe ramifications as a result of data thefts that occurred in 2005. A Federal Trade Commission (FTC) investigation found that the company did not adequately protect the personal information of its members which resulted in tens of thousands of credit card numbers being stolen by hackers.

Citigroup, DSW Shoe Warehouse, Bank of America, Time Warner, Lexis Nexis, Ameritrade, and many of others have gone through similar ordeals and suffered similar consequences.

The costs of doing nothing can be high

In addition to the specific incidents mentioned above, consider some other data points that can quickly add up:

• Costs to companies responding to data breaches can include disclosure/notification costs, customer satisfaction costs (e.g., offering free credit reporting services for a year), public relations expenses, settlement expenses (e.g., with the FTC), legal expenses, fines, increased fraud/security staffing, fraud loss and prevention, IT audits (e.g., FTC-mandated or proactively identifying vulnerabilities requiring remediation), new technology, and associated staffing

• There is no single number that captures aggregate costs across all incidents, especially since the incidents can vary dramatically:
o Laptop theft
o Backup tape loss
o Physical server theft
o General email phishing attacks

• The per-person cost of offering free credit reports to impacted individuals for a year is estimated to be $80-$100 and above in volume; for an incident such as Fidelity’s laptop loss, that alone represents around $15-$20 million

• Reissuing credit cards costs to affected consumers can cost the issuer about $10 per card