Zero Trust Pays Dividends For Data Breach Management

The new edition of IBM and Ponemon Institute's annual Cost of a Data Breach report provides deep insights into corporate data breach management. Beyond offering a number for the average cost of a data breach — $4.35 million in 2021 — the report also highlights many of the factors that contribute to the cost of a breach, both positively and negatively.

Over the past several years, remote work and zero trust have featured heavily in corporate digital transformation strategies. The 2022 Cost of a Data Breach report quantifies the impact that both of these trends have on the average cost of a data breach to an organization.

Data Breach Costs Vary by Industry

Across all industries, the average cost of a data breach was $4.35 million in 2021. However, this number covers a great deal of variation across industries. For example, in critical infrastructure organizations — where such an incident can result in a loss of competitive advantage and/or a significant disruption to operations — the average cost of a breach was $4.82 million. In contrast, a breach of a public sector organization carried an average cost of $2.07 million. This is still an alarming number to be sure, but it is less than half than amount seen in critical infrastructure.

Remote Work Doesn't Have to Equal Security Risk

Not surprisingly, the widespread adoption of remote work during the COVID-19 pandemic has had a significant impact on the average cost of a data breach. The average cost of a data breach caused by remote work is almost $1 million higher than in cases where it was not. This fact is likely to influence companies as they decide whether to permit long-term remote and hybrid work. 

However, while remote work can increase the cost of a data breach, organizations that wish to continue supporting remote work can take steps to mitigate the cost and impacts of data breaches caused by remote workers.  On average, the cost of a data breach for an organization with a zero trust strategy in place is nearly $1 million lower than those without. Looking at organizations with zero trust deployed, a mature zero trust program saves $1.5 million in losses compared to one in its early stages.

Supporting remote work can have major benefits for an organization, including a dramatic widening of the talent pool and a decrease in overhead costs. Still, as the report makes clear, implementing remote work without the right precautions comes at a cost.

How to Ensure Remote Work Security

Remote work can be a major contributor to data breaches because remote work infrastructure makes attackers’ jobs easier. If it is possible to log into corporate systems and applications remotely — an essential requirement for remote work — bad actors who have stolen or otherwise obtained employee credentials can leverage this same access in their attacks.

Most instances in which remote access led to a data breach involved situations where remote work infrastructure was adopted without adding modern authentication solutions and security protections. Legacy remote access solutions, such as VPNs, authenticate users a single time and then, in most cases, provide nearly unrestricted access to corporate networks and assets. This makes it easy for an attacker to achieve access and then extend their initial foothold by moving laterally within a company’s IT infrastructure. The eventual result is likely be a costly breach of sensitive and valuable corporate and customer data.

Implementing remote work correctly and securely — and replacing or augmenting vulnerable, inefficient VPNs with zero trust network access (ZTNA) — restricts an account’s access to those that are required to perform its role within the business.  Eliminating unnecessary access makes attackers’ jobs more difficult, increasing their probability of detection and causing the decreased costs of data breaches highlighted in the report. 

Driving Down the Costs of Data Breaches with Cyolo

The 2022 Cost of a Data Breach report reveals a clear ROI for investment in modern security technologies. For 83% of the surveyed organizations, the data breach(es) that they suffered in 2021 was not their first breach. 

Cyolo makes it easy for organizations to secure their remote work infrastructure with zero trust access supported by strong authentication. Comprehensive visibility and full audit logging provide valuable insight for preventing and responding to attempted data breaches.

Learn more about securing your remote workforce and lowering the risk of data breaches by scheduling a free demo.