Companies spend huge sums to protect their networks and assets from cyber attacks. Kaspersky Labs has budgeted around $9 million for enterprise security. However, cheap and easy-to-use hacking make it very easy for criminals to gain access.
Cyber attacks are cheaper than cyber security
The cost of attack versus defense is vast. Top10VPN estimates that a PayPal account is worth less than $100. Visa and Mastercard credit card information is available for $10. Even bank information for entire accounts is only worth $1,000, even if the account has up to $15,000 in it. In many cases, the old information is simply given away for free. This is in stark contrast to the penalties imposed on businesses for losing files.
Lessons on how to build attacks are available for just $5.
How much does a cyber attack cost?
Entire attack campaigns can, in some cases, cost the same as a good meal:
- A complete phishing campaign including hosting, phishing kit: $500 per month on average with prices starting at $30 per month
- An information/theft campaign (malware, hosting and distribution): $723 on average with prices as low as $183
- Ransomware and remote access Trojan attacks: Average $1,000 for a campaign
- Banking Trojan campaign: an initial outlay of around $1,400, but can reach $3,500
The “barrier” to access costs less
Deloitte estimates that even a low-level cyberattack costing just $34 per month could set back $25,000, while more expensive and sophisticated attacks costing a few thousand dollars could set back as much as $1 million per month. Meanwhile, IBM estimates that the average cost to a business of a data breach is $3.86 million.
What the CISO should know about cyber crime markets
Cheap, simple attacks, says Brogan, a leader at Deloitte Cyber Risk Services, shouldn't be too much of a concern for IT teams. "If your security operations are running well, $100-type attacks can't hurt you.".
According to Brogan, knowing as much as possible about service providers is just as important as knowing about the threat actors they employ against your network.
Finally, he adds that even if it's difficult to make the cost of doing business too high for criminals, when it's so cheap, you can make your organization a less attractive target for attackers.
