Assessing Cyber Threats - The Blind Spot Between Perception and Realty


A recent survey by the Ponemon Institute entitled, “Cyber Security Incident Response: Are We as Prepared as We Think?,” suggests that many companies lack the mechanisms to meaningfully address cyber risk. Among the survey’s findings:

  • Although companies recognize that better incident response capabilities would mitigate the harm cyber attacks cause, most companies devote less than 10 percent of their security budget to incident response and this percentage has remained static over the past 24 months.
  • Most organizations do not track the time to identify and respond to incidents or the effectiveness of the response. As a result, organizations have no means to measure the actual time and costs involved in managing cyber risk.
  • Companies are overly optimistic about the time to identify intrusions and address any damage the attack caused. Many respondents estimated that attacks could be identified in hours. As breaches at Target and Verizon have shown, identifying a cyber attack can take months or even years and fixing the problem could take just as long.
  • Organizations can reduce reputational harm by promptly and credibly communicating with the public about data breaches. Yet only 23% of the companies have a public relations plan in place in the event of a security breach. 
  • Executive management and boards are seldom engaged in cyber issues and thus remain in the dark about the real nature of the threat.

A growing number of companies have recognized the need for cyber risk insurance. Yet for this market to continue to grow, perceptions about cyber threats must shift. Companies cannot appreciate the need for insurance without better understanding the actual costs involved in responding to cyber attacks.       

To learn more about the Ponemon survey, click here.


Written by:

Published In:

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Hinshaw & Culbertson LLP | Attorney Advertising

Don't miss a thing! Build a custom news brief:

Read fresh new writing on compliance, cybersecurity, Dodd-Frank, whistleblowers, social media, hiring & firing, patent reform, the NLRB, Obamacare, the SEC…

…or whatever matters the most to you. Follow authors, firms, and topics on JD Supra.

Create your news brief now - it's free and easy »

All the intelligence you need, in one easy email:

Great! Your first step to building an email digest of JD Supra authors and topics. Log in with LinkedIn so we can start sending your digest...

Sign up for your custom alerts now, using LinkedIn ›

* With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name.