If you're researching the true cost of a data breach, let me help you out and tell you that nobody knows. There's no standard for reporting what is and isn't included in the cost. IT overtime to rebuild systems? Sure that makes sense. But many costs aren't black and white 1/n
GRC time to write new control policies?
Replacing your outdated VPN concentrator?
Finally migrating off of Win 2k3?
Installing AV organization wide?
Pentesting to find other exposures?
Threat hunting to find other actors in the network?
All of these have been included 2/n
Replacing your outdated VPN concentrator?
Finally migrating off of Win 2k3?
Installing AV organization wide?
Pentesting to find other exposures?
Threat hunting to find other actors in the network?
All of these have been included 2/n
I'm not saying whether these things should or shouldn't be included (I have WAY worse examples BTW). My point is that when an organization says "this was a $5 million breach" that carries as much meaning as saying I'll sell you a car for 25 grizblocks. No frame of reference. 3/n
Ugh, I just realized that someone will create a crypto currency called "grizblocks" just to invalidate my point. But I digress... Without clear standards on what is/isn't included in the cost of a breach, we can't make ANY actionable recommendations based on available data. 4/n
You should be immediately suspicious of vendors peddling this data without caveats. They are either ignorant of what the data does (and doesn't) mean or they are being intentionally dishonest. Neither is a good outcome for you... 5/5
