Asia Pacific cyberattack costs are higher than you think

Yu goes through the different types of losses sustained in a cyberattack.

A Microsoft and Frost & Sullivan study* has revealed that:

• A large organisation in Asia Pacific could incur an economic loss of US$30 million, more than 300 times the average economic loss for a mid-sized organisation

• Cybersecurity attacks have led to job losses in almost seven in 10 (67%) organisations over the last year

• Cybersecurity concerns delay digital transformation plans; and

• Organisations are increasingly leveraging artificial intelligence to enhance their cybersecurity strategies

A Frost & Sullivan study commissioned by Microsoft revealed that the potential economic loss across Asia Pacific due to cybersecurity incidents can hit US$1.745 trillion. This is more than 7% of the region’s total GDP of US$24.3 trillion**.

The study, Understanding the Cybersecurity Threat Landscape in Asia Pacific: Securing the Modern Enterprise in a Digital World, aims to provide business and IT decision makers with insights on the economic cost of cybersecurity breaches in the region and identify the gaps in organisations’ cybersecurity strategies. The study was conducted with 1,300 business and IT decision makers ranging from mid-sized organisations (250 to 499 employees) to large organisations (> 500 employees) across the Asia Pacific region.

The study reveals that more than half of the organisations surveyed have either experienced a cybersecurity incident (25%) or are not sure if they had one as they have not performed proper forensics or data breach assessment (27%).

“As companies embrace the opportunities presented by cloud and mobile computing to connect with customers and optimise operations, they take on new risks,” said Eric Lam, Director, Enterprise Cybersecurity Group, Microsoft Asia. “With traditional IT boundaries disappearing the adversaries now have many new targets to attack. Companies face the risk of significant financial loss, damage to customer satisfaction and market reputation—as has been made all too clear by recent high profile breaches.”

Lam shares key findings from the Microsoft Security Intelligence Report Volume 23 report. What stood out this round: botnets, low-hanging fruit for hackers and ransomware.

The study found that:

• A large organisation in Asia Pacific could incur an economic loss of US$30 million, more than 300 times higher than the average economic loss for a mid-sized organisation (US$96,000); and

• Cybersecurity attacks have resulted in job losses across different functions in almost seven in 10 (67%) organisations that have experienced an incident over the last 12 months.

To calculate the cost of cybercrime, Frost & Sullivan has created an economic loss model based on
macroeconomic data and insights shared by survey respondents. This model factors in three kinds of losses which could be incurred due to a cybersecurity breach:

• Direct

Financial losses associated with a cybersecurity incident - this includes loss of productivity, fines, remediation costs, etc.;

• Indirect: The opportunity costs to the organisation such as customer churn due to reputation loss; and

• Induced: The impact of the cyber breach to the broader ecosystem and economy, such as the decrease in consumer and enterprise spending.

Edison Yu, VP and Asia Pacific Head of Enterprise for Frost & Sullivan, said that enterprises must think about which cyberthreats are making the largest impact, rather than how many attacks they sustain.

“Although the direct losses from cybersecurity breaches are most visible, they are but just the tip of the iceberg,” he said. “There are many other hidden losses that we have to consider from both the indirect and induced perspectives, and the economic loss for organisations suffering from cybersecurity attacks can be often underestimated.”

In addition to financial losses, cybersecurity incidents are also undermining Asia Pacific organisations’ ability to capture future opportunities in today’s digital economy, with one in six (59%) respondents stating that their enterprise has put off digital transformation efforts due to the fear of cyber-risks.

Although high-profile cyberattacks, such as ransomware, have been garnering a lot of attention from enterprises, the study found that for organisations in the Asia Pacific that have encountered cybersecurity incidents, fraudulent wire transfer, data corruption, online brand impersonation and data exfiltration are the biggest concern as they have the highest impact with the slowest recovery time.

Besides external threats, the research also revealed key gaps in organisations’ cybersecurity approach to protect their digital estate:

• Considering security as an afterthought

Despite encountering a cyberattack, one in four (25%) organisations consider cybersecurity before the start of a digital transformation project, as compared to one in three (34%) organisations that have not encountered any cyberattack. The rest of the organisations either think about cybersecurity only after they start on the project, or do not consider it at all. This limits their ability to conceptualise and deliver a “security-by-design” project, potentially leading to insecure products going out into the market;

"The projects that move the fastest are the projects that have security considered right at the outset," said Lam.

• Creating a complex environment

While it seems logical that deploying more cybersecurity solutions means stronger protection, the survey actually revealed that fewer than one in four (23%) of respondents with more than 50 cybersecurity solutions could recover from three cyberattacks within an hour. In contrast, almost twice as many respondents (40%) with fewer than 10 cybersecurity solutions responded that they can recover from cyberattacks within an hour; and

• Lacking cybersecurity strategy

While more and more organisations are considering digital transformation to gain competitive advantage, the study has shown that a majority of respondents (41%) see cybersecurity strategy only as a means to safeguard the organisation against cyberattacks rather than a strategic business enabler. Just 20% of organisations see cybersecurity strategy as a digital transformation enabler.

“The ever-changing threat environment is challenging, but there are ways to be more effective using the right blend of modern technology, strategy, and expertise,” added Lam. “Microsoft is empowering businesses in Asia Pacific to take advantage of digital transformation by enabling them to embrace the technology that’s available to them, securely through its secure platform of products and services, combined with unique intelligence and broad industry partnerships.”

In a digital world where cyberthreats are constantly evolving and attack surface is rapidly expanding, AI is becoming a potent opponent against cyberattacks as it can detect and act on threat vectors based on data insights. The study reveals that three in four (75%) of organisations in Asia Pacific have either adopted or are looking to adopt an AI approach towards boosting cybersecurity. AI’s ability to rapidly analyse and respond to unprecedented quantities of data is becoming indispensable in a world where cyberattacks’ frequency, scale and sophistication continue to increase.

 An AI-driven cybersecurity architecture will be more intelligent and be equipped with predictive abilities to allow organizations to fix or strengthen their security posture before problems emerge. It will also grant companies with the capabilities to accomplish tasks, such as identifying cyberattacks, removal of persistent threats and fixing bugs, faster than any human could, making it an increasingly vital element of any corporate cybersecurity strategy.

For a cybersecurity practice to be successful, organisations need to consider people, process and technology, and how each of these contributes to the overall security posture of the organisation. Microsoft lists five best practices that they can consider in improving their defense against cybersecurity threats:

• Position cybersecurity as a digital transformation enabler

The disconnect between cybersecurity practices and digital transformation effort creates a lot of frustration for the employees. Cybersecurity is a requirement for digital transformation to guide and keep the company safe through its journey. Conversely, digital transformation presents an opportunity for cybersecurity practices to abandon ageing practices to embrace new methods of addressing today’s risks;

• Continue to invest in strengthening security fundamentals

Over 90% of cyber incidents can be averted by maintaining the most basic best practices. Maintaining strong passwords, conditional use of multifactor authentication against suspicious authentications, keeping device operating systems, software and anti-malware protection up-to-date and genuine can rapidly raise the bar against cyberattacks. This should include not just toolsets but also training and policies to support stronger fundamentals;

• Maximise skills and tools by leveraging integrated best-of-suite tools

According to Microsoft, the best tools are useless in the hands of the amateur. Reduce the number of tools and the complexity of your security operations to allow the team to hone their proficiency with the available tools. Prioritising best-of-suite tools is a great way to maximise risk coverage without the risk of introducing too many tools and complexity to the environment. This is especially true if tools within the suite are well-integrated to take advantage of their counterparts;

"Look at best of suite capabilities instead of best of breed," said Lam. "If it's integrated you get a better sense of your security posture."

• Assessment, review and continuous compliance

The organisation should be in a continuous state of compliance. Assessments and reviews should be conducted regularly to test for potential gaps that may occur as the organisation is rapidly transforming and address these gaps. The board should keep tab on not just compliance to industry regulations but also how the organisation is progressing against security best practices; and

• Leverage AI and automation to increase capabilities and capacity

With security capabilities in short supply, organisations need to look to automation and AI to improve the capabilities and capacity of their security operations. "Companies are starting to look actively at AI deployments...because there is no way to cover up there skill gaps," said Yu.

Current advancements in AI have shown a lot of promise, not just in raising detections that would otherwise be missed but also in reasoning over how the various data signals should be interpreted with recommended actions. Such systems have seen great success in cloud implementations where huge volumes of data can be processed rapidly. Ultimately, leveraging automation and AI can free up cybersecurity talents to focus on higher-level activities, Microsoft says. Yu added that threat intelligence is becoming a popular cyberdefence weapon as companies can then better predict and protect their environments.

Source: Microsoft infographic. There are direct, indirect and induced losses due to cyberattacks in the Asia Pacific region.

Explore:

Download the Microsoft Security Intelligence Report Volume 23

*Understanding the Cybersecurity Threat Landscape in Asia Pacific: Securing the Modern Enterprise in a Digital World, conducted by Frost & Sullivan in partnership with Microsoft Asia, involved a survey conducted with 1,300 respondents from 13 markets - Australia, mainland China, Hong Kong, Indonesia, India, Japan, Korea, Malaysia, New Zealand, Philippines, Singapore, Taiwan and Thailand. All respondents are business and IT decision-makers involved in shaping their organisations’ digital strategy. Forty-four percent of them are business decision-makers, including CEOs, COOs and directors, while 56% are IT decision-makers, including CIOs, CISO and IT Directors. A third (29%) of participants are from mid-sized organisations (250 to 499 staff); and 71% are from large organisations (more than 500 staff).

**World Bank Asia Pacific GDP