{"id":3218,"date":"2015-03-15T20:29:02","date_gmt":"2015-03-15T20:29:02","guid":{"rendered":"http:\/\/www.lifeandnews.com\/articles\/?p=3218"},"modified":"2016-08-07T18:35:02","modified_gmt":"2016-08-07T18:35:02","slug":"why-companies-have-little-incentive-to-invest-in-cybersecurity","status":"publish","type":"post","link":"https:\/\/www.lifeandnews.com\/articles\/why-companies-have-little-incentive-to-invest-in-cybersecurity\/","title":{"rendered":"Why companies have little incentive to invest in cybersecurity"},"content":{"rendered":"

By Benjamin Dean<\/a>, Columbia University<\/a><\/em><\/p>\n

Editor\u2019s note: US President Barack Obama is seeking US$14 billion to tackle it. The UK wants to build a start-up industry around it. And Australia is in the middle of what could be a year-long review into getting better at it. The issue is cybersecurity, and at risk is the entire digital economy and consumer confidence in it. In this Cyber insecurity series<\/a>, we investigate the size and nature of the cybercrime threat, the industry growing with it, and the solutions emerging to better tackle it.<\/em><\/p>\n

Another month, another data breach<\/a>, and another set of proposals for what is seemingly an intensifying cyberattack problem.<\/p>\n

When we examine the evidence, though, the actual expenses from the recent and high-profile breaches at Sony, Target and Home Depot amount to less than 1% of each company\u2019s annual revenues. After reimbursement from insurance and minus tax deductions, the losses are even less.<\/p>\n

This indicates that the financial incentives for companies to invest in greater information security are low and suggests that government intervention might be needed.<\/p>\n

To date, though, few of the policy proposals aimed at improving information security are directed towards the root cause of this problem. Rather than creating incentives for companies to invest in better information security, the Australian, UK and US government proposals are for more information sharing than securing. In all cases, this sharing is to be done with intelligence agencies. Why is this and what does it tell us about what the real cyberthreat to our information is?<\/p>\n

The real fallout from data breaches<\/h2>\n

The now infamous Sony breach supposedly perpetrated by North Korea at the end of 2014 drew initial loss estimates of more than $100 million<\/a>. In the end, the breach did not actually cost Sony very much at all.<\/p>\n

In its Q3 2014 financial statements<\/a>, the company wrote that the breach resulted in \u201cjust $15 million in \u2018investigation and remediation costs\u2019 and that it doesn\u2019t expect to suffer any long-term consequences.\u201d A senior general manager later said the figure would be closer to $35 million<\/a> for the fiscal year ending March 31.<\/p>\n

To give some scale to these losses, they represent from 0.9% to 2% of Sony\u2019s total projected sales for 2014 and a fraction of the initial estimates.<\/p>\n

How about costs like reputation damage and lost sales? Sony\u2019s bottom line actually wasn\u2019t hurt by the hack. Consider that around a quarter of the typical movie budget is marketing. The Interview cost $44 million to make, which implies a conservative estimate of $11 million for marketing. This amount was likely ratcheted down following the breach and the subsequent free worldwide media frenzy.<\/p>\n

The film made a profit and has so far grossed $40 million in online sales and $6.7 million in cinemas worldwide. If anything, the free publicity for a new movie on cable news, across social networks and daily newspapers, at Christmas to boot, represents a net financial benefit to Sony. There\u2019s no such thing as bad press, after all.<\/p>\n

Target was also subjected to a particularly nasty data breach in late 2013 involving 40 million credit and debit card records and 70 million other records (including addresses and phone numbers).<\/p>\n

In its latest financial statements<\/a>, Target said the gross expenses from the data breach were $252 million. When we subtract insurance reimbursement, the losses fall to $162 million. If we subtract tax deductions (yes, breach-related expenses are deductible), the net losses tally $105 million.<\/p>\n

\"\"<\/a>
While the initial costs of Target\u2019s data breach were high, the actual cost to the company was 40% less in 2013 and 2014 after reimbursement for insurance and related tax savings.<\/span>
\nTarget<\/span><\/span><\/figcaption><\/figure>\n

This is the equivalent of 0.1% of 2014 sales.<\/p>\n

Finally, Home Depot suffered a breach last year that resulted in 56 million credit and debit card numbers and 53 million email addresses being stolen.<\/p>\n

The net expenses incurred by Home Depot ended up at $28 million following an insurance reimbursement of $15 million<\/a>. This represents less than 0.01% of Home Depot\u2019s sales for 2014.<\/p>\n

Moral hazard rears its head<\/h2>\n

These numbers suggest that we have a market failure relating to asymmetric information, which results in the problem of \u201cmoral hazard\u201d for private companies in the area of information security. Moral hazard occurs when one person or organization takes greater risks because others bear the burden or costs of those risks.<\/p>\n

For an example, credit and debit card providers incurred the most costly part of the Home Depot breach. Credit unions claim to have spent $60 million<\/a> in September 2014 alone replacing compromised cards. Each customer whose card had to be replaced also incurred a cost in terms of inconvenience.<\/p>\n

It therefore does not make economic sense for companies like Home Depot to make large investments in information security. As a result, they do not. The insurance pay-outs and tax deductible breach-related expenses weaken the incentives even more.<\/p>\n

Reliable data on the amounts companies spend on information security are scarce. However, due to the nature of their business and the vital role that information security plays in it, we know that banks and financial institutions are some of the biggest investors in robust information security.<\/p>\n

JP Morgan\u2019s CEO, Jamie Dimon, says his firm spends $250 million<\/a> each year on cybersecurity. To put that in perspective, that constitutes 0.35% of the JP Morgan\u2019s annual expenses.<\/p>\n

If that\u2019s how much a firm whose very existence rests on preventing data breaches, one can only imagine how much the average firm invests in information security.<\/p>\n

The growing slew of government proposals<\/h2>\n

In the presence of this market failure, the case for government intervention becomes strong. When we look at the proposals currently on offer though, rather than better securing information they seek to increase access to it \u2013 for certain organizations only.<\/p>\n

The most recent of these proposals in Australia is the mandatory metadata retention scheme. This will involve retaining and sharing people\u2019s metadata for two years (representing an additional information security risk in of itself due to the centralization of information), cost $400 million a year and be overseen by the nation\u2019s Intelligence agencies. According to Prime Minister Tony Abbott, if not passed, this will represent a \u201ca form of \u2018unilateral disarmament\u2019 in the fight against crime<\/a>.\u201d (these crimes include, \u201ccyber attacks, child exploitation, terrorism activity and other crimes<\/a>\u201d.)<\/p>\n

To try and put this spending in perspective, figures released by the Western Australian government suggest that $17 million was lost to online scammers last year<\/a>. If we scale this up to the total Australian population and add the $254 million lost to online (\u201ccard-not-present\u201d) credit and debit card fraud<\/a> nationally in 2013, the total losses from these online crimes still don\u2019t exceed the yearly cost of Abbott\u2019s proposal! There must be some other reason to justify this spending.<\/p>\n

One possible answer: in 2010, one of same the agencies within the Australian Intelligence community that is proposed to oversee the metadata retention scheme \u201cobtained nearly 1.8 million encryption keys<\/a> from Indonesian telco Telkomsel,\u201d for the purposes of \u201cconducting surveillance of a US law firm retained by the Indonesian government for trade talks.\u201d This last phrase suggests that the real value in greater information sharing with Intelligence agencies does not come from fighting online crimes.<\/p>\n

In the US, President Barack Obama recently announced a Cyber Threat Intelligence Integration Center<\/a>. Tasked with facilitating information sharing between private and public sector entities, it will start with a budget of $35 million<\/a> and will be overseen by the director of national intelligence. Information security experts widely agree<\/a> this will not significantly reduce data breaches.<\/p>\n

Prime Minister David Cameron also has proposals to combat cybercrimes ranging from banning encryption<\/a> in the event the government has no backdoor to decrypt communications (again, something that would undermine the security instead of improving it) to a number of information sharing measures<\/a> between the UK and US. This would include \u201cestablishing a joint cyber cell\u201d between the UK\u2019s Government Communications Headquarters and MI5 and their US partners, the National Security Agency and the Federal Bureau of Investigation.<\/p>\n

These organizations already collaborate quite a bit and it is not for improving information security. The news broke two weeks ago that operatives from the NSA and GCHQ \u201cjoined forces<\/a> in April 2010 to crack mobile phone encryption\u201d by stealing billions of encryption keys from Dutch SIM card provider Gemalto. This has some of the biggest negative repercussions on information security we\u2019ve ever seen to everyone, globally, as Australian Senator Scott Ludlam tried in vain to explain last month<\/a>.<\/p>\n

More questions than answers<\/h2>\n

Given that the losses to companies due to data breaches are so low, typically less than 1% of a company\u2019s annual sales, and the losses so widely distributed, why are so many costly proposals being made by governments around the world to do something about the online threat?<\/p>\n

The presence of moral hazard does suggest that there is a role for government to play in creating incentives for private companies to invest more in information security.<\/p>\n

Why then do none of the current crop of government proposals address this problem? More costly than the problems they supposedly address, if anything, they create a disincentive for companies to make this needed investment by promising blanket protection from cyber-attacks. The Australian and UK proposals may actually degrade information security by centralizing data and undermining encryption.<\/p>\n

This might be exactly the point, though, when we look at which agencies are to be engaged in these proposals.<\/p>\n

Improving information security should fundamentally involve securing information, yet all the current proposals involve greater information sharing with intelligence agencies. Why are the same agencies that have been shown to be active in undermining the information security of private firms such as Indonesia\u2019s Telkomsel<\/a> or the Dutch Gemalto<\/a> \u2013 and all of their customers (anyone with a cell phone – so all of us) \u2013 as a consequence of these actions, being tasked with better securing our information?<\/p>\n

If we don\u2019t identify and address these contradictions, we run the risk of creating something much worse than the current information security problem. The latest slew of government proposals raise more questions than answers regarding information security – and they are very concerning questions indeed.<\/p>\n

\"The<\/p>\n

This article was originally published on The Conversation<\/a>.
\nRead the original article<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Benjamin Dean, Columbia University Editor\u2019s note: US President Barack Obama is seeking US$14 billion to tackle it. The UK wants to build a start-up industry around it. And Australia is in the middle of what could be a year-long review into getting better at it. The issue is cybersecurity, and at risk is the […]<\/p>\n","protected":false},"author":40,"featured_media":5189,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[30,46,36,4],"tags":[930,931,614,612,892,885,891,860],"_links":{"self":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/3218"}],"collection":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/users\/40"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/comments?post=3218"}],"version-history":[{"count":3,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/3218\/revisions"}],"predecessor-version":[{"id":5190,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/3218\/revisions\/5190"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media\/5189"}],"wp:attachment":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media?parent=3218"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/categories?post=3218"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/tags?post=3218"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}