As the cost per cybercrime victim continues to rise, Internet security awareness firm KnowBe4 says that businesses without security training are vulnerable to data breaches and, as a result, future class-action lawsuits.
(TAMPA BAY, FL), Nov. 18, 2013 -- Cybercrime has been branded the number one threat to United States security—although the number of cybercrime victims declined in 2013, the cost per victim has increased 50 percent, bringing the global total to a staggering $113 billion (1). As the costs of data breaches continue to skyrocket—and businesses expose themselves to potential class-action lawsuits on behalf of third parties—Internet security awareness training firm KnowBe4warns small and medium-sized enterprises (SMEs) to effectively arm themselves against cyberattacks before litigation ensues; KnowBe4 says that security awareness training triples the chances of an organization being able to decrease its phishing problems.
Recent studies show that over the past four years, cybercrime costs have climbed by an average of 78 percent, while the time required to recover from a breach has increased 130 percent:
In the United States alone, the annual cybercrime cost seen by the 60 businesses studied ranged from $1.3 million to more than $58 million and averaged $11.6 million per company—an increase of $2.6 million from 2012.
The average cost of cleaning up after a single successful attack was $1 million (2).
But the costs of correcting data breaches are no longer the only cause for concern—the legal consequences, such as class-action lawsuits on behalf of third parties affected by such cyberattacks, are a growing worry of business owners. Businesses—specifically those that guard individuals' personal information, such as banks and data brokers—have become a likely target for consequential litigation in the aftermath of security breaches.
Case in Point:
Identity thieves posed as customers to steal more than 160,000 consumer records from data broker ChoicePoint. After the information theft was publicly announced, ChoicePoint paid out some $45 million as a result of the breach, and in the process effectively created a new source of liability for organizations nationwide (3).
Stu Sjouwerman, founder of KnowBe4, maintains that businesses can effectively bypass the financial burden of data breaches by implementing Internet security awareness training designed to teach employees to recognize and avoid potential "hack-attacks."
"Antivirus software cannot keep up with the sophisticated tactics of professional hackers, and should not be depended upon as a reliable means of defense," Sjouwerman said. "Internet security training has proven to work by lessening the chances of a successful cyberattack."
Sjouwerman says that the best defense is to think like a hacker, as phishing and social engineering tactics become increasingly sophisticated and difficult to detect. KnowBe4 collaborated with Kevin Mitnick, once known as the "World's Most Wanted Hacker," to develop Kevin Mitnick Security Awareness Training, a product designed to help organizations defend against even the most advanced network security breaches.
But even as cybercriminals constantly refine their techniques, KnowBe4 recently announced that an upgraded Kevin Mitnick Security Awareness Training program is in the beginning stages, and will be unveiled in 2014. The program is interactive and web-based, with case studies, live demonstration videos and short tests.
Sjouwerman's authority was confirmed by a study conducted by Osterman Research, which specializes in conducting market research for IT and technology-based companies.Sjouwerman classified five types of security awareness training that organizations commonly implement:
1. The Do-Nothing Approach:The organization conducts no security awareness training.
2. The Breakroom Approach:Employees are gathered during lunches or meetings and are told what to look out for in emails, web surfing, etc.
3. The Monthly Security Video Approach:Employees are shown short videos that explain how to keep the
organization safe and secure.
4. The Phishing Test Approach:Certain employees are pre-selected and are sent simulated phishing attacks; IT determines whether they fell prey to the attack; and those employees receive remedial training.
5. The Human Firewall Approach: Everyone in the organization is tested; the percentage of employees who are prone to phishing attacks is determined; and then everyone is trained on major attack vectors. Simulated phishing attacks are sent to all employees on a regular basis.
The research found that KnowBe4's security awareness training program, categorized as a "human firewall approach, not only increased confidence in employee capability to distinguish phishing attempts and malware, but also nearly tripled the chances of an organization decreasing its phishing problem."
KnowBe4's client base is comprised of over 300 customers, 42% of whom are banks and credit unions, and all of whom have successfully reduced the rate of employees clicking on spear-phishing links by up to 80% or more.
For more information about KnowBe4 and its services, contact KnowBe4 online at www.knowbe4.com.
About Stu Sjouwerman and KnowBe4:
Stu Sjouwerman is the founder and CEO of KnowBe4, LLC, which provides web-based Security Awareness Training to small and medium-sized enterprises.A data security expert with more than 30 years in the IT industry, Sjouwerman was the co-founder of Inc. 500 company Sunbelt Software, an award-winning anti-malware software company that he and his partner sold to GFI Software in 2010. Realizing that the human element of security was being seriously neglected, Sjouwerman decided to help entrepreneurs tackle cybercrime tactics through advanced security awareness training. He and his colleagues work with companies in many different industries, including highly-regulated fields such as healthcare, finance and insurance. Sjouwerman is the author of four books, with his latest being Cyberheist:The Biggest Financial Threat Facing American Businesses Since the Meltdown of 2008.
1. Mlot, Stephanie. "Cost Per Cybercrime Victim Skyrockets." Pcmag.com. N.p., 01 Oct. 2013. Web. 08 Nov. 2013. pcmag.com/article2/0,2817,2425118,00.asp.
2. Schwartz, Mathew. "Cybercrime Costs Skyrocket." Informationweek.com. N.p., 08 Oct. 2013. Web. 08 Nov. 2013. informationweek.com/security/management/cybercrime-costs-skyrocket/240162379.
3. "Data Breach Lawsuits Roll on as Lawyers Work to Establish Legal Precedent." Scmagazine.com. SC Magazine, 03 Sept. 2013. Web. 11 Nov. 2013. scmagazine.com/data-breach-lawsuits-roll-on-as-lawyers-work-to-establish-legal-precedent/article/309439/?(3)Ponemon 2013 Cost of a Data Breach Report.
