![](https://securitybridge.com/wp-content/uploads/2024/09/Madrid-2024-300x157.png)
Secure Together on the Road – November 28th, 2024
Join industry leaders for a one-day event in Madrid to explore SAP security solutions and fortify your enterprise against evolving threats.
At SecurityBridge, we follow developments and trends in the IT security field closely. Researching and developing SAP Security Knowledge helps us further enhance and improve our product while optimally securing our clients’ SAP landscapes.
Earlier this year, IBM presented its 18th edition of ‘The Cost of a Data Breach Report’ (you can find it here). This publication provides detailed and valuable insights into various factors related to data breaches. It is based on research carried out at 553 impacted organizations – any IT security professional should check it out. In this article, we will highlight some of this report’s findings and bring them into the context of SAP security.
The detailed background of findings, research methodology and definitions (like the definition of a data breach) are explained in the report and not repeated in this article. Disclaimer: we don’t take credit or responsibility for this research and its findings. It is not specific to the domain of SAP landscapes, but we believe the results are nonetheless indicative.
One of the most prominent findings is that the average total cost of a data breach is a staggering USD 4.45 million. Though, it is an average number that can vary greatly depending on factors like country, industry, size, complexity of the organization, etc. The report shows several breakdowns for further review and comparison. Important points to note are:
Another interesting finding is that small organizations are by no means safeguarded from high costs because of size. Although the costs are lower overall, they have increased considerably for smaller organizations compared to 2022. In our previous blog post, we already discussed data breaches at small and medium-sized businesses.
The mean time to identify a data breach (MTTI) is 204 days, and the mean time to contain the breach once identified (MTTC) is 73 days. This brings the average data breach lifecycle to no less than 277 days.
Consider these numbers for a moment. They regard important, if not vital data for organizations, like personally identifiable information (PII), financial or medical account details or data that is otherwise secret or confidential. Data that lies right at the heart of many critical business processes. When this kind of crucial data is compromised, it takes organizations, on average, more than six months to become aware of it, and then more than two months are needed to deal with its backlash. Apart from the costs, these numbers are serious. Especially since the MTTI and MTTC are no exception for 2023 – but are quite stable compared to recent years.
Data breaches are costly and take a long time to identify and contain – this is for sure. But what are the causes, and who identifies a data breach? Phishing and stolen or compromised credentials are the most common attack vectors, leading to about 30% of data breaches. But other vectors are also noteworthy, like data breaches because of cloud misconfiguration and malicious insiders.
What is even more interesting is that organizations’ internal security teams identify only one-third of data breaches! Most data breaches are discovered by external entities, such as benign third parties or the attackers themselves responsible for the breach (as seen in cases like ransomware).
Many organizations have adopted cloud solutions in recent years and for understandable reasons. In terms of data security, this has a significant impact. 82% of the data breaches concern data stored in cloud environments, and the majority concern multiple environments (39%). We already highlighted ‘cloud misconfiguration’ as an attack vector, and by these numbers, that makes perfect sense. It is also noteworthy that data breaches at public and multiple cloud environments contribute to higher average costs and a longer data breach life cycle.
Fortunately, it is not all doom and gloom from the report – there is also good news. Several measures can be taken to reduce the cost of data breaches and the time needed to identify and contain them. We highlight the following:
As said, the report is not specific to SAP landscapes. But looking at the findings and recommendations, there are some striking similarities with the practice of SAP Security. To name a few:
All these characteristics are amplifying factors for both data breach costs and lifecycles. They clearly show that also SAP landscapes are highly susceptible to the risk of data breaches and that this deserves full attention. Interestingly, only 51% of the researched organizations that face a data breach plan to increase security investments…
The severe impact of data breaches and the fact that only a limited number of them are discovered by organizations’ security teams calls for action to take control of IT security and apply effective countermeasures. As an SAP security software vendor, our goal is to deliver the most effective solution, turning this ambition into a reality for organizations utilizing SAP. With the SecurityBridge platform, we deliver the capabilities that matter in a single platform for both on-premises and cloud-based SAP technology stacks. From a data breach standpoint, our solution closely relates to and enables important cost mitigators and significantly shortens data breach lifecycles.
Try SecurityBridge and immediately improve the security of your SAP systems! For more SAP security-related news, articles, and whitepapers, please follow us on LinkedIn!
Posted by
Find recent Security Advisories for SAP©
Looking into securing your SAP landscape? This white-paper tells you the “Top Mistakes to Avoid in SAP Security“. Download it now.
Join industry leaders for a one-day event in Madrid to explore SAP security solutions and fortify your enterprise against evolving threats.
Complete SAP Security Assessment Checklist: Essential Steps and Best Practices In this blog, you’ll find a detailed SAP security assessment checklist including what to look
The article looks at the risks and solutions of an overlooked SAP security vulnerability in default accounts.