Average cost of a data breach up 12.5 percent among Canadian Firms

2016/07/05 by admin

Canadian CISOs who want more hard data to convince the C-suite and boards to devote more resources to cybersecurity have a new report to show.

If a study of 24 Canadian organizations is accurate, the total cost over a recent 12 month period of a breach of over 1,000 records went up 12.5 per cent compared to 2014 to just over $6 million.

Another way of looking at it is the average cost per record stolen or lost went up 10.6 per cent to $278 compared to the same period the year before.

These numbers come from a study released last week by the Ponemon Institute that was funded by IBM. The costs were based upon estimates provided by participating victim organizations.

The report is part of an annual global study of breaches in 13 countries (United States, United Kingdom, Germany, Australia, France, Brazil, Japan, Italy, India, the United Arab Emirates, Saudi Arabia, Canada and, for the first time, South Africa), which last year covered 383 organizations. The average cost of a breach across all those firms was US$4 million.

Importantly, the study included the cost of losing customers: Of the Canadian companies studied, for those that lost less than one per cent of their existing customers the average total cost of a breach was $4.77 million, well below the global averae of $6.03 million. When companies had a churn rate of greater than 4 per cent, the average cost was $7.88 million.

There are two cautions: First, Ponemon admits that 24 firms is a small sample for this country, and second, only organizations that suffered a breach of between 1,000 and 100,000 lost or stolen records in 2015 were counted – meaning Ashley Madison isn’t there. That way catastrophic incidents don’t skew the results.

The number of Canadian breached records per incident in the study period ranged from 4,800 to 70,998 and the average number of breached records was 21,200.
“Over the many years studying the data breach experience of more than 2,000 organizations in every industry, we see that data breaches are now a consistent ‘cost of doing business’ in the cybercrime era,” said institute head Larry Ponemon. “The evidence shows that this is a permanent cost organizations need to be prepared to deal with and incorporate in their data protection strategies.”

The report has other interesting numbers:

–It took more than five months to detect that an incident occurred and almost two months to contain the incident;

–54 per cent of the Canadian data breaches studied were caused by malicious or criminal attacks, 25 per cent were caused by human error and 21 per cent by system glitches. Companies that experienced malicious attacks had a per capita data breach cost of $304, which is above the average for all organizations studied. In contrast, companies that experienced system glitches ($250) or employee negligence ($246) had per capita costs below the mean value;

–The more records lost, the higher the cost of the data breach. The cost ranged from $3.59 million for data breaches involving 10,000 or fewer lost or stolen records to $6.88 million for the loss or theft of more than 50,000 records;

–Notification costs increased. These costs include IT activities associated with creation of contract databases, determination of all regulatory requirements, engagement of outside experts, postal expenditures and inbound communication set-up. The average cost increased from $0.12 million in 2015 to $0.18 million in 2016;

–Lost business costs increased. This cost category typically includes the abnormal turnover of customers, increased customer acquisition activities, reputation losses and diminished goodwill. Among all the 383 companies studied these costs increased from an average US$1.99 million in 2015 to US$2.24 million in 2016 — that’s of the overall $4 million average cost.

“The biggest financial consequence to organizations that experienced a data breach is lost business,” says the report.

Both direct and indirect per capita costs increased significantly. The indirect cost of data breach includes costs related to the amount of time, effort and other organizational resources spent to resolve the breach. In contrast, direct costs are the actual expense incurred to accomplish a given activity such as purchasing technology or hiring a consultant.

Direct expenses include engaging forensic experts, outsourcing hotline support and providing free credit monitoring subscriptions and discounts for future products and services. Indirect costs include in-house investigations and communication, as well as the extrapolated value of customer loss resulting from turnover or diminished customer acquisition rates.

LogRhythm - Earns Recommended Designation and 5 Stars

2016/05/05 by admin

Business Wire

Independent Testers Praise LogRhythm as “Most Complete, Pure-play SIEM”

BOULDER, Colo.-(BUSINESS WIRE)-LogRhythm, The Security Intelligence Company, today announced that its Security Intelligence Platform, has earned the “RECOMMENDED” designation and a perfect five-star rating in SC Magazine’s 2016 SIEM and UTM Group Test. The reviewers specifically called out LogRhythm’s “next-gen features and superlative correlation and analytics” as its primary strengths.

As part of the SIEM and UTM Group Review, SC Magazine tested six solutions. The review emphasized that LogRhythm’s security intelligence platform is “a heavy-duty tool made for a demanding large environment. It is scalable and complete with the largest list of supported connectors we’ve seen yet.”

“Information security teams value advanced analytics, efficient incident response, and effective workflow and collaboration in the platform they place at the center of their security operations. It’s not surprising then that LogRhythm received SC Magazine’s “RECOMMENDED” designation in this year’s lab test,” said Mike Reagan, chief marketing officer at LogRhythm. “This review highlights why enterprises around the globe are increasingly selecting LogRhythm’s Security Intelliegence and Analytics Platform to bolster their ability to detect, respond to and neutralize advanced cyber threats through comprehensive threat lifecycle management.”

SC Magazine stated that LogRhythm is the “most complete, pure-play SIEM we’ve seen.” It went on to say about the LogRhythm solution, “It has the intelligence to analyze, correlate and make sense of huge amounts of data.”

LogRhythm’s unified Security Intelligence Platform integrates next-gen SIEM and log management with network forensics, endpoint monitoring and multidimensional security analytics. LogRhythm provides deep visibility into threats and risks to which organizations are otherwise blind. Designed to help prevent breaches before they happen, LogRhythm accurately detects an extensive range of early indicators of compromise, enabling rapid response and mitigation.

The deep visibility and understanding delivered by LogRhythm’s Security Intelligence Platform empowers enterprises to secure their networks and comply with regulatory requirements.

The SC Magazine review can be found online at: http://www.scmagazine.com/utm-and-siem/grouptest/361/.

Big data analytics a useful security tool, says analyst

2016/04/26 by admin

By Warwick Ashford - Security Editor - ComputerWeekely.com

The majority of companies using big data security analytics report a high business benefit, according to the Business Application Research Center

Big data analytics is a useful tool for enabling organisations to become more resilient in the face of increasing cyber attacks, according to a software market analyst and IT consultant.

“A recent survey found that 53% of organisations that are using big data security analytics report a ‘high’ business benefit,” said Carsten Bange, founder and managing director of the Business Application Research Center (Barc).

“The survey also found that 41% reported a ‘moderate’ benefit and only 6% said benefit was ‘low’, so there is fairly strong evidence of the business benefits of big data security analytics, ” he told Computer Weekly.

While adoption across the board is still relatively low, more than two-thirds of the more advanced companies surveyed are adopting advanced big data security analytics technologies, such as user behaviour analytics, the Barc survey revealed.

The more advanced companies, which classified themselves as having “much better” skills and competency in security analytics than their companies, represented 13% of the total sample, with 68% saying they have deployed user behaviour analytics.

“Of the 87% who did not consider themselves to be in the more advanced group, only 27% have deployed user behaviour analytics,” said Bange.

User behaviour analytics can help improve an organisation’s cyber security resilience, he said, by tracking user behaviour across all IT systems, for example, to identify whenever there are significant deviations from normal behaviour to warn of potential malicious activity.

“There is nothing new in being able to identify patterns of behaviour – most of the analysis techniques are 30 to 40 years old – but now we are able to apply them to extremely large data sets across multiple information technology systems,” said Bange.

“Organisations need to know there is now the technology to support this kind of analysis that can be very beneficial in the field on information security. It can enable organisations to become more resilient through data-driven security decision-making, planning and incident responses,” he said.

Read Full Article ->

LogRhythm - Better Defense in on Tool

2016/04/07 by admin

LogRhythm mashes up security and big data to give SMBs better defense in one tool

by Jason Hiner TechnRepublic

Security Intelligence Management (SIM) can even the playing field between IT and cybersecurity attackers. Here’s how one of the leaders in the space offers a real-time battle strategy.

LogRhythm Dashboard

The LogRhythm interface and dashboard is built in HTML5.

Image: LogRhythm

A lot of SMBs feel overmatched by the bad guys in cybersecurity. And, for good reason—they are. Most attackers have abundant time to find the latest software vulnerabilities and the best techniques for exploiting weaknesses.

Even companies that have plenty of firewalls, anti-malware, and threat detection still struggle to keep attackers out of their networks% of companies reported that their networks were breached in 2015, according the 2016 Cyberthreat Defense Report.

The problem is that these companies are at a serious intelligence disadvantage.

To fight that, a new breed of security product has emerged in the last few years called “security intelligence management” (SIM). These products use big data—about the methods attackers use to breach networks—and put it to work in targeted ways to identify and respond to potential break-ins as they’re happening.

Timeliness is key, because the average time between a breach and an organization discovering it is 146 days, according to Mandiant’s M-Trends 2016 report.

One of the leaders in the SIM market is LogRhythm, a company I met this week in Orlando at the Midmarket CIO Forum, where their message played well to a crowd of 200 overworked, under-resourced CIOs and CMOs.

Read Full Article ->

To find out more about LogRhythm - give us a call at 866-431-8972 or email us at [email protected]

LogRhythm - Harnessing your Inner SIEM

2016/03/21 by admin

ITWire - Ray Shaw March 21, 2016

Security information and event management (SIEM) is an approach to security management that provides a holistic view of an organization’s IT security.

The buzzword in 2015 was cyber threat intelligence (CTI) - everyone wanted useful data and analytical tools for next-gen cyber security to detect and respond to threats faster. The industry responded by providing a plethora of CTI products.

Matt Willems, a four-year, Labs Engineer, at LogRhythm has written a good overview of CTI and SIEM. Of course it is from a LogRhythm perspective.

He works closely with the Machine Data Intelligence team to collect consistent data for its Co-Pilot Program, develop new rule blocks for advanced correlation and builds parsing rules to support new devices. He also provides Incident Response support—analysing and interpreting data and delivering up-to-date content for the Knowledge Base to neutralize threats faster.

He starts by defining what cyber threat intelligence means and how to leverage successfully the information that is already in the SIEM ecosystem.

What is Cyber Threat Intelligence?

SC Magazine’s free Cyberthreat Intelligence e-book, (registration required) discusses CTI, the benefits of integrating into an organization’s defence strategy, as well as the different threat sharing initiatives and alliances.

Gartner defines CTI as evidence-based knowledge - including context, mechanisms, indicators, implications and actionable advice - about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject’s response to that menace or hazard.

“It can also be described as the process of detecting potential and actual threats using evidenced-based data, responding to them and defeating the attackers using forensic and logical data the attackers themselves leave behind,” according to SC Magazine’s Cyberthreat Intelligence e-book.

Without actionable data, there is no proactive defence. An effective CTI sets up the appropriate countermeasures automatically for drastically improved detection and response times.

Next-Gen Log Management to Facilitate CTI

CTI requires a log management tool [such as LogRhythm] to correlate the information to make the raw data collected actionable.

“The absolute minimum barrier to entry is a security information and event management (SIEM) or log management product of some sort. Then you at least have something to correlate the information that’s coming into your security ecosystem,” says Andrew Hay, CISO at DataGravity.

LogRhythm contextually structures every log message to store and understand what the data means.

Identify Nefarious Activity with a Distributed Set of Data

Every attack is different. All cyber-attacks have indicators of compromise (IOCs). Feeding IOCs into a SIEM provides full visibility into the network. With this information, a SIEM will correlate the logs from across the network to form a distributed set of data.

An effective CTI solution can identify various touch points as a potential hazard using the distributed data set. Instead of looking at the attack pattern as a whole, it should only need one command before automating a response and thwart an attack.

LogRhythm’s AI Engine has over 70 metadata fields that provide highly relevant data for analysis and correlation and over 900 preconfigured, out-of-the-box correlation rule sets. It can accurately define “normal” activities and automatically alarm for nefarious activities.

Make Data Actionable Out-of-the-Box

The goal of cyber threat intelligence is to draw actionable data from the thousands of log files and data streams to identify signs of nefarious behaviour. SIEMs can efficiently correlate log messages and set off alarms. Once these behaviours are detected an effective CTI product will automate your response based on the digital evidence before a breach takes place.

“It’s not just detecting a potential attack or compromise, it’s a question of what you’re going to do about it,” says Michael Orosz, director of Decision System Group, Information Sciences Institute, Viterbi School of Engineering, University of Southern California.

LogRhythm’s SmartResponse operationalizes data out-of-the-box to make it actionable. Once an alarm is set off, it enables an automated response or a semi-automated response with a sophisticated approval process.

Employ Honeypots for an Adaptive and Proactive Response

Honeypots are isolated systems such as web servers designed to look like part of the corporate network. These decoy systems are easy to exploit, to make them an attractive target for opportunist attackers.

Honeypots provide the actionable data necessary for cyber threat intelligence without compromising the network. By monitoring honeypot activity, an organization can learn about targeted threats and use this information to understand who they are being targeted by, what information their adversaries are seeking and how attack patterns will look within the network. This information enables proactive threat defence.

LogRhythm’s Honeypot Security Analytics Suite automatically tracks and analyzes an attacker’s actions to create a behaviour profile. If an observed attacker’s behaviour on the honeypot is mirrored by similar action within the environment, AI Engine automates a SmartResponse.

Cyber threat intelligence combines data left behind by attackers and innovative analytics to create the next-generation of cybersecurity intelligence.