SoylentNews

Arthur T Knackerbracket [soylentnews.org] writes:

Story automatically generated by StoryBot Version 0.1.0a (Development).

Note: This is the complete story and will need further editing. It may also be covered by Copyright and thus should be acknowledged and quoted rather than printed in its entirety.

FeedSource: [TheRegister] collected from rss-bot logs

Time: 2016-08-11 05:00:29-11:00 UTC

Original URL: http://www.theregister.co.uk/2016/08/11/your_cybercrime_cost_studies_are_rubbish_enisa/ [theregister.co.uk]

Title: Cyber-crime cost calculation studies are rubbish: ENISA

Suggested Topics by Probability (Experimental) : 16.4 hardware 16.4 business 14.5 science 9.1 mobile 9.1 digiliberty 9.1 OS 5.5 techonomics 5.5 code 3.6 technomics 3.6 security 3.6 careersedu 1.8 careers 1.8 breaking

--- --- --- --- --- --- --- Entire Story Below --- --- --- --- --- --- ---

Cyber-crime cost calculation studies are rubbish: ENISA

Arthur T Knackerbracket has found the following story [theregister.co.uk]:

ENISA, the European Union Agency For Network And Information Security, has taken a look at “cost of cyber attack” studies and reckons they're not much good.

The agency is far too polite to put it that way, but in this report [europa.eu], it says there's no consistent approach to trying to quantify the cost of attacks on what it calls critical information infrastructures (CIIs).

“The measurement of the real impact of incidents in terms of the costs needed for full recovery proved to be quite a challenging task”, the report drily notes.

The study, The cost of incidents affecting CIIs, is a review eleven expert reports, two internal studies (provided by security vendors to customers), two public studies, and two reports by ENISA partners. The source studies were dated between 2013 and 2015.

The agency says there's plenty of information about, but the studies it analysed “examines the topic from a different perspective, focusing on certain industries, using different metrics, counting only certain types of incidents etc. The lack of a common approach and criteria for performing such an analysis has allowed the development of rarely comparable standalone studies, often relevant only in a certain context.”

Still, the authors – ENISA's Dr Dan Tofan, Theodoros Nikolakopoulos and Eleni Darra – were able to extract some insights from the studies they reviewed.

While it won't surprise anyone that the financial, ICT and energy sectors have the highest per-incident costs, denial-of-service and insider attacks are the most common incident types in finance and ICT.

Those two attack types are responsible for about half the “annualised cost of all cybercrime”, the report reckons.

The big problem comes when people try to quantify what an attack actually costs. The studies ENISA reviewed put costs anywhere from €425,000 to €20 million per company per year in Germany(from the Ponemon Institute); although it may be between €2.3 million and €15 million per company per year (also from the Ponemon Institute).

With error bars like that, it's impressive that ENISA was able to glean anything useful from the literature at all. Unsurprisingly, the report reckons if we're going to get a handle on what's happening, such studies need "a well-structured methodology".

What a novel idea ... ®

Original Submission