text: Data breach costs are very expensive. No, wait they’re not. Over 60% of companies go bankrupt after a data breach! But probably not. What about reputational harm to a company? It could be over-hyped but after Equifax, it could also be significant. And aren’t credit card fraud costs for consumers a serious matter? Maybe not! Is this post starting to sound confusing?
  When I was tasked with looking into data breach costs, I was already familiar with the great Verizon DBIR vs. Ponemon debate: based on data from 2014, Ponemon derived an average cost per record of $201 while Verizon pegged it at $.58 per record. In my book, that’s an enormous difference. But it can be explained if you dive deeper.
  After looking at one too many research paper, presentation and blog post on the subject of data breach costs, I started to see that once you absorb a few underlying ideas, you understand what everyone is yakking about.
  The first issue to take up is the average of a data sample. In fact, this blog’s favorite statistician Kaiser Fung lectured us on this point a while back. When looking at a data set, a simple average of the numbers works well enough as long as the distribution of the number is not too skewed – has a spike or clump at the tail end.
  But as Fung points out, when this is not the case, the average leads to inconsistencies, as in the following hypothetical data set of breach record counts over two years:
  For 2015, the average of 1172 is off by several multiples for seven of the ten companies! And if we compare this average to the following year’s average of 930, we could incorrectly conclude that breach counts are down.
  This usually leads to a discussion of how numbers are distributed in a dataset, and that the median number, where 50% or less of the data can be found, is a better representation than an average — especially for skewed data sets. Kaiser is very good at explaining this.
  For those who want to get a head start on the next post in this series, they can scan this paper, which has the best title on a data security topic I’ve come across, Sex, Lies and Cyber-crime Surveys. This was written by those crazy folks at Microsoft. If you don’t want to read it, the point is this: for skewed data, it’s important to analyze how each percentile contributes to the overall average.
  How does Ponemon determine the cost of a data breach? Generally, this information is not easily available. However, in recent years, theses costs have started to show up in annual reports for public companies.
  But for private companies and for public companies that are not breaking breach costs out in their public financial reporting, you have to do more creative number crunching.
  Ponemon surveys companies, asking them to rate the costs for common post-breach activities, including auditing & consulting, legal services, and identity protection fees. Ponemon then categorizes costs into whether they’re direct — for example, credit monitoring — or fuzzier indirect or opportunity costs — extra employee time or potential lost business.
  It turns out that these indirect costs represent about 40% of the average cost of a breach based on their 2015 survey. These costs mean something, but they’re not really accounting costs. More on that next time.
  Recently, other researchers have been able to get a hold of far better estimate of the direct breach costs by examining actual cyber insurance claims. Companies, such as Advisen and NetDiligence, have this insurance payout data and have been willing to share it.
  The cyber insurance market is still immature and the actual payouts after deductibles and other fine print don’t represent the full direct cost of the breach. But this is, for the first time, evidence of direct costs.
  Anyway, the friendly people over at RAND — yes, the very same company who worked this out — used these data sets to guesstimate an average breach cost per incident of about $6 million – wonks should review their paper. This tracks very closely with Ponemon’s $6.5 million per incident estimate for roughly the same period.
  Before you start shouting into your browser, I realize I used an average above to estimate a very skewed (and as we’ll see heavy-tailed) set.
  In any case, several studies including the RAND one, have focused on per incident costs rather than per record costs. At some point, the Verizon DBIR team also began to de-emphasize the count of records exposed, realizing that it’s hard to get reliable numbers from their own forensic data.
  In the 2015 DBIR report, the one where they announced their provocative $.58 per record breach cost claims, the researchers relied on, for the first time, a dataset of insurance claim data from NetDiligence.
  Let me just say that the DBIR’s average cost ratio is heavily influenced by a few companies with humongous breached record counts — likely in the millions — reflected in the denominator and smaller total insurance payouts for the numerator. As we saw in my made-up example above, the average in this case is not very revealing.
  Why not use multiple averages customized over different breach count ranges? I hope you’re beginning to see it’s far better to segment the cost data by record count: you look up in a table to find the costs appropriate for your case. And Verizon did something close to that in the 2015 DBIR to come with a table of data that’s nearer Ponemon’s average for the lower tiers:
  Counting breach data record provides some insight into understanding total costs, but there are other factors: the particular industry the company is in, regulations they’re under, credit protection costs for consumers, and company size. For example, take a look at this breach cost calculator based on Ponemon’s own data.
  You can understand why the average breach cost per record number is so popular: it provides a quick although unreliable answer for the total cost of a particular breach.
  To derive the $201 average cost per record, Ponemon simply added up the costs (both direct and indirect) from their survey and divided by the number of records breached as reported by the companies.
  This may be convenient for calculations but as a predictor, it’s not very good. I’m gently walking around the topic of linear regressions, which is one way to draw a “good” straight line through the dataset.
  Wonks can check out Jay Jacobs’ great post on this in his Data Driven Security blog. He shows a linear regression beating out the simple Ponemon line with its slope of 201 — by the way, he gained direct access to Ponemon’s survey results. Jacobs’ beta is $103, which you can interpret as the marginal cost of an additional breached record. But even his regression model is not all that accurate.
  I want to end this post with this thought: we want the world to look linear, but that’s not the way it ticks.
  Why should breach costs go up by a fixed amount for each additional record stolen? And for that matter, why do we assume that 10% of the companies in a data breach survey will contribute 10% to the total costs, the next 10% will add another 10%, etc.
  Sure for paying out credit monitoring costs for consumer and replacing credit cards that were reissued by litigious credit card companies, costs add up on a per record basis.
  On the other hand, I don’t know too many attorneys, security consultants, developers, or pen testers who say to new clients, “We charge $50 a data record to analyze or remediate your breach.”
  Jacobs found a better non-linear model — technically log-linear which is fancy way of saying the record count variable has an exponent in it. In the graph below — thank you Wolfram Alpha! — I compared the regression line (based on the Ponemon data) against the more sophisticated model from Jacobs. You can gaze upon the divergence or else click here to explore on your own.
  In the next post, I hope all this background will payoff as I try to connect these ideas to come up with a more nuanced way to understand data breach costs.
  Viruses and worms are often used interchangeably: there are a few key differences in how they work. Both viruses and worms are a type of malware: a worm is a type of virus.
  Computer viruses are named after human viruses that spread from person to person. A computer virus is a program made of malicious code that can propagate itself from device to device. Like a cold that alters your well-being, when your computer is infected, it alters the way your computer operates, can destroy your files, or prevent it from working altogether.
  A virus typically attaches itself to a program, file, or the boot sector of the hard drive. Once the virus attaches itself to that file or program (aka, the host), they’re infected.
  When the infected application or file runs in the computer, the virus activates and executes in the system. It continues to replicate and spread by attaching replicas of itself to other files and applications in the system.
  A virus spreads when the infected file or program migrates through networks, file collaboration apps, email attachments, and USB drives. Once a user opens the infected file or program, the vicious cycle repeats itself all over again.
  Typically, the host program continues to function after the viral infection, but some viruses overwrite entire programs with copies of themselves, which corrupts and destroys the host program altogether. Viruses can also attack data: they can disrupt access, corrupt, and/or destroy your data.
  Worms are a self-replicating type of malware (and a type of virus) that enter networks by exploiting vulnerabilities, moving quickly from one computer to another. Because of this, worms can propagate themselves and spread very quickly – not only locally, but have the potential to disrupt systems worldwide.
  Unlike a typical virus, worms don’t attach to a file or program. Instead, they slither and enter computers through a vulnerability in the network, self-replicating and spreading before you’re able to remove the worm. But by then, they’ll already have consumed all the bandwidth of the network, interrupting and arresting large network and web servers.
  In 2017, the WannaCry worm attack caused damage worth hundreds of millions to billions of dollars. Also known as WannaCry ransomware, this attack is a hybrid of ransomware and a worm – specifically cryptoworm.
  Ransomware is a type of malware that holds a user’s data hostage: it encrypts data and asks the victim to pay a ransom, betting on the user’s willingness to pay to restore the user’s data. Ransomware infections often occur through phishing campaigns.
  Instead, WannaCry took advantage of a vulnerability in Microsoft’s SMB Version 1 file sharing protocol, typically used by Windows machines to communicate with file systems over a network. Those who didn’t patch SMB Version 1 learned the hard way about the perils of forgetting to patch their systems.
  In short, WannaCry self-propagated, self-replicated, and quickly traversed entire networks, causing worldwide damage.
  Varonis DatAdvantage monitors and analyzes file and email activity – as well as user behavior. When there’s an unusual amount of lockouts that occur or a thousand files are opened in a minute, Varonis DatAlert can detect these anomalies, automate security responses, and enable teams to investigate security incidents directly in the web UI. Varonis Edge adds context with perimeter telemetry, detecting signs of attack at the perimeter via DNS, VPN, and Web Proxies.
  Discover how Varonis can help defend against worms and viruses – see Varonis in action with a 1:1 demo today.
  ...a Bachelor of Science in Industrial Engineering in 2008, and Universitat Politecnica de Catalunya with a Bachelor of Science in Optometry in 1996. My style of tutoring is quite flexible. I like to adjust to the learning needs of the student, because each person learns in a different way. Each subject is also different and...
  ...Space" experiment allowed me to fly for over ninety minutes on the amazing flight and the experience still inspires my work today. I have been honored by receiving several "teacher of the year" awards from various local, state, and national organizations. I am excited to be able to do the work that I love -...
  ...years of experience under my belt and a Bachelor's in Biology. I am currently working for a tech giant. I have years of tutoring STEM subjects and being a mentor for undergraduate students in Upstate New York. The world of science and how the human body interacts with its surroundings fascinates me! Therefore, it is...
  ...surgery in Houston, Texas. I have a Masters degree in medical science from the PA program at Mercer University in Atlanta. My undergraduate degree was obtained from The College of William and Mary in 2011 with Bachelor of Science degrees in Biology and Psychology. I tutored elementary-aged students during college and have continued to tutor...
  ...Saint Louis University College of Public Health and Social Justice working towards my Master's in Public Health with a concentration in Epidemiology. I completed my undergraduate studies at Saint Louis University as well, receiving a Bachelor of Science in Health Sciences. In addition to the core curriculum for my major, I also completed all of...
  ...a junior at Colorado School of Mines, studying Engineering Physics. As a physics major, I know the importance of understanding the fundamentals of a subject before trying to focus on specifics, especially in math and science. I try to have a very flexible teaching style, as I know not everybody learns in the same way,...
  ...to the individual student. I also believe syllabus oriented teaching is key to covering adequate material to allow a student to test well. I have solid communication and people skills that will allow me to easily establish rapport with my students and their parents. I pride myself in pushing past average, and I wish to...
  ...able to craft and implement lesson plans designed for individual students, as well as facilitate group sessions. I have experience teaching Supplemental Instruction at Auburn University, where in addition to lecture materials, I provided study skills and academic success strategies to my students. I am a National Merit and National Hispanic Scholar, and I received...
  ...in informal teaching environments to keep lesson plans structured but exciting. I work primarily with elementary, middle school and early high school age students. I also take adult learners, particularly for test prep. Students can expect to set their own learning goals with my support, work hard, and celebrate successes just as enthusiastically.... I believe the best way to motivate a student is to help them get excited about the subject! Students should know about interesting and cool examples of their subject in the modern world, and they should understand its application to their own lives. I motivate with lots of positive reinforcement. We will set realistic goals, and we'll celebrate their accomplishment.
  ...Master's graduate who just recently moved back home to the Atlanta area. I have a broad scientific background in biology, math, chemistry, psychology, neuroscience, and anatomy but have specialized my career in the direction of marine biology and animal behavior in particular. I'm great with kids and have a passion for math and science, and...
  ...with a holistic understanding of the social sciences in its entirety, as well as a more focused understanding of individual social science disciplines. My instruction has earned me strong teaching evaluations in both forums, as well as repeated contract renewals. In addition to my teaching experience, I have a strong background as a researcher, having...
  ...basic study skills, I can help you or your child accomplish your goals in a respectful, patient, and personalized manner. As a life-long learner, I have a passion for teaching and rely on my educational background in neuroscience and psychology to help develop individualized learning and tutoring plans to help students accomplish their academic and...
  ...do you need the new information? If you need to pass a test to accomplish a goal further down the line, I have acquired test taking strategies that work and will happily share them. If you struggle with a subject that you're "not good" you may be surprised at how good you can be with...
  ...went on to obtain my M.S.Ed. in Curriculum and Instruction from Saint Vincent College in 2009. I have tutored for many years in the subjects of physics, general science, chemistry, and mathematics. I have also spent several years as a lacrosse coach in the area. My favorite subject to tutor is physics. I like it...
  ...Scholars, a mentoring program and DC Reads, a program specifically designed to eradicate illiteracy in students of DC Public Schools. Through these programs, I worked with students from the age of 5 to 18 years old. While I tutor a broad range of subjects, I am most passionate about Reading, Comprehension and other English/Literature focused...
  ...it. I appreciate feedback (online or in person) from every lesson, and I will work to improve and change my strategies to meet your needs. I am extremely flexible. I will meet you at a place that is most convenient and must suited to your specific learning needs. I look forward to hearing from you...
  ...me because of their applications to the technology we use in everyday life. As a tutor, these are my favorite subjects to work with because they involve definite answers that are firmly rooted in logic. My mission in helping students with these subjects is to show them how to break down complex problems into simple...
  ...open up new avenues of where you want your writing to go. After graduation, I worked as an adjunct faculty member at Pitt, Jefferson Community College in Steubenville, Ohio, and Duquesne University. The subjects I most commonly taught were English Composition courses and Writing for Business. I also taught Creative Writing for the Western Pennsylvania...
  I enjoy working one on one with students to increase their understanding, learning and confidence. I like to use different methods of teaching, depending on the individual and their strengths. I am an advocate for determination, organization, and hard work in approaching learning and achieving success in school. ... In a first session, I talk with students about what they are struggling with most and any concerns they may have initially.
  ...NFL players as well as Italian to high school-aged students. I believe that learning another language is a very rewarding journey. As a native speaker of Italian, I can attest to the fact that learning about the culture is imperative to learning the language including history, food, music, customs, etc. Hence, as I tutor second...