I recently wrote a blog post outlining what to do in the first 24 hours after you have been breached, and in my conclusion I mentioned that capturing the incident in a case study could help unlock budget in future. Today, I want to look at this in more detail, and consider the approaches you can take to analyse the cost of a breach in order to make a request for appropriate preventative spend.
Security teams often attempt to capture the hypothetical cost of a data loss incident, but it is incredibly hard to convincingly calculate the complex factors of a potential data loss incident because every organisation will require its own formula based on its business model, market conditions, and the data it holds. Not all data is equal, and even within a single data set, value and associated risk can fluctuate dramatically over time. And then there is the fact that these calculations are hypothetical anyway—even if you reach a defensible number you have to anticipate a reluctance to acknowledge the likelihood of the incident occurring in the first place.
After an incident has occured, you are perfectly placed to prove not only that incidents occur, but that they have real costs attached.
S