Counting the Cost of Cyber Crime

It has been a busy month in cyberspace. TJX, the massive worldwide fashion retailer, is finally releasing some of the gory details of the recent hack which saw over 45 million credit and debit card details stolen from their databases.

The entire fiasco has cost the company an estimated $17 million to date.

Estimating the cost of an intrusion has never been easy. It is something that IT managers grapple with regularly, particularly when fighting for budgets.At a basic level, the most obvious cost component associated with a security incident of any kind is the cost of human labor that will be inevitably required to investigate the breach, often resulting in lost productivity as well as lost time.

Thankfully, most organizations have a very accurate indication of how much each and every employee's time costs, so putting a monetary figure on this component is straightforward enough.

One of the major challenges of the security community is to develop an effective return on investment calculation that will allow them to justify security expenditures before catastrophic incidents occur.

It is much more difficult to put an accurate and realistic figure on many of the other 'softer' knock-on effects of a security breach.
Loss of reputation is probably the most contentious issue, and the one that the majority of security technology vendors tout as the 'justification' for purchasing their products.

Ultimately, it pays to invest upfront in IT security, be it technology, training, policy initiatives or prevention mechanisms.