The heavy cost of ignoring dwell time

By Susan Richardson, Manager/Content Strategy, Code42

If you’re among the 44% of organizations that aren’t measuring Mean Time to Identify (MTTI), more commonly known as dwell time, then how will you know if you’re reducing it, which is a critical step to improving incident response?

The average dwell time for a major data breach today is months: Mandiant puts it at 205 days, and a Ponemon Institute survey tallied 98 days for Financial Services and 197 days for Retail. With all that free time to roam in your system, attackers can wreak more havoc than just sifting through your information for vulnerabilities, identifying critical information, mapping your network and stealing millions of records.

The fallout of a data breach can also include:

Loss of business: A recent Brunswick Group report found that 34% of customers no longer shopped at a retailer due to a past data breach issue. But retail is among the least-likely industries to experience customer churn. The three industries most susceptible to losing customers following a breach are Health Care, Pharmaceuticals and Financial Services, according to a 2014 Ponemon Institute global study. It also found that France, Italy and the United Kingdom had the highest customer turnover.

Significant lawsuits: An average single data breach claim, according to a recent NetDiligence study, costs a company $733,109, at a cost–per-record of $956.21. Home Depot, in its 10-Q filing with the SEC following a breach, reported that it was facing at least 44 lawsuits. Target paid $10 million to settle its class action lawsuit and another $19 million to reimburse financial institutions for the charges they incurred reissuing compromised cards.

A drop in company valuation: While stock price is affected by many factors, The Brunswick Group analyzed 10 companies that recently experienced a large data breach and found that the average daily stock price dropped and hadn’t yet recovered two quarters later.

Executive casualties: Target CEO Gregg Steinhafel resigned five months after the retailer’s highly publicized breach in December 2013, with the company’s official statement noting “he held himself personally responsible.”

An LA Times story following the more recent Anthem data breach talks about what’s at stake for company CEO Joseph Swedish, who was already fighting to improve the insurer’s customer service reputation before hackers compromised 78 million records in a typosquatting scheme.