Published by Gbaf News
Posted on March 29, 2018
12 min readLast updated: January 21, 2026
Fourth annual report provides insights and trends drawn from analysis of more than 560 incidents managed by the firm’s privacy and data protection team in 2017
Many entities face the same types of security incidents – some are viewed as handling the incident well, and for some it’s a disruptive and costly lesson. The ones that fare better have prepared for an incident and use lessons-learned from prior incidents. Recognizing that entities need a source of reliable information on what actually happens during an incident, the BakerHostetlerPrivacy and Data Protection team published the 2018 edition of its Data Security Incident Response Report. The 2018 Report contains statistics and insights based on more than 560 data security incidents managed by the firm in 2017. The Report provides practical measures entities can use to prioritize risk management goals and be better prepared to respond to an incident when it happens. The Report calls this using Compromise Response Intelligence to be Compromise Ready.
“Compromise Response Intelligence should be used by entities to prioritize and gain executive support for security spending, educate key stakeholders, fine-tune incident response plans, work more efficiently with forensic firms, assess and reduce risk, build scenarios for tabletop exercises and determine cyber liability insurance needs,” said Theodore J. Kobus III, leader of BakerHostetler’s privacy and data protection practice.
As noted in previous years, the Report emphasizes that entities need to be “Compromise Ready” by setting up defenses to lessen the number of incidents and having systems in place to respond – being cyber resilient – in order to reduce the risk of attacks and lessen their severity when they do occur.
“The stakes are higher than ever, but some entities still are not executing on the basics. Many have made great strides in their cybersecurity planning, but as threats evolve and entities change, they must also keep their security protocols current. It takes an ‘all-in’ approach from boards to senior management to entry level employees for best-in-class breach prevention and response planning,” Kobus noted.
Incident Causes
The Report shows that phishing remained the leading cause of incidents at 34 percent, followed by network intrusions at 19 percent, inadvertent disclosure (such as an employee mistake) at 17 percent and stolen or lost devices/records at 11 percent. A new category this year is system misconfiguration, which reflects instances where unauthorized individuals gain access to data stored in the cloud because permissions were set to “public” instead of “private,” and was responsible for six percent of incidents.
“Contrary to what some might expect, cloud security issues are not occurring because the cloud service providers are being compromised, but rather because of how the entity itself or its service provider configured access to the cloud instance,” added Kobus.
Increased Regulatory Scrutiny
Entities also need to be aware that regulators have become aggressive in investigating breaches, with upticks in not only the number of inquiries by regulators (i.e. 64 by state attorneys general and 43 non-AG investigations in 2017 compared to 37 state AGs and 29 non-AG investigations in 2016), but also in the speed by which they are being made. And when the General Data Protection Regulation (GDPR) and its quick notification and onerous financial consequences for non-compliance become effective on May 25, 2018 for entities established in the EU, the regulatory landscape will be even more challenging.
Response Timeline
One of the most important features of the Report is the incident response timeline, which identifies the four key time frames of the incident response lifecycle – detection, containment, analysis, and notification. This timeline gives entities context for understanding the timing of when they will have reliable information to facilitate communication about the incident.
Overall incident response times for 2017 were 66 days from occurrence to discovery (an increase of five days from 2016), three days from discovery to containment (an improvement of five days from 2016), 36 days from engagement of forensics team to investigation complete (four days faster than the previous year), and 38 days from discovery to notification (three days better than 2016).
Forensics Drives Key Decisions
In the data breach incidents analyzed in the Report, 41.5 percent employed the use of outside forensic investigators. The average cost of a forensic investigation was $84,417 in 2017 compared with an average cost of $62,290 in 2016. “The ability to quickly and efficiently conduct a forensic investigation is critical to helping answer essential questions about the incident, including: What happened? How did it happen? How do we contain it? Who do we need to inform? How can we protect affected individuals?” noted Kobus.
Other interesting trends/numbers from this year’s analysis include:
Compromise Response Intelligence
The Report provides a list of recommendations that entities can follow in order to help mitigate the opportunity for breaches to happen as well as to help lessen the severity of data breach incidents when they occur. The list, which includes suggestions from previous years that still hold true, has been updated to address issues/matters that have recently become prevalent. Some of the new headings address keeping data in the cloud, the increase in regulatory scrutiny, the need for entities to adopt multifactor authentication, and implementing a robust risk management program that incorporates complete buy-in from all levels of an organization.
Fourth annual report provides insights and trends drawn from analysis of more than 560 incidents managed by the firm’s privacy and data protection team in 2017
Many entities face the same types of security incidents – some are viewed as handling the incident well, and for some it’s a disruptive and costly lesson. The ones that fare better have prepared for an incident and use lessons-learned from prior incidents. Recognizing that entities need a source of reliable information on what actually happens during an incident, the BakerHostetlerPrivacy and Data Protection team published the 2018 edition of its Data Security Incident Response Report. The 2018 Report contains statistics and insights based on more than 560 data security incidents managed by the firm in 2017. The Report provides practical measures entities can use to prioritize risk management goals and be better prepared to respond to an incident when it happens. The Report calls this using Compromise Response Intelligence to be Compromise Ready.
“Compromise Response Intelligence should be used by entities to prioritize and gain executive support for security spending, educate key stakeholders, fine-tune incident response plans, work more efficiently with forensic firms, assess and reduce risk, build scenarios for tabletop exercises and determine cyber liability insurance needs,” said Theodore J. Kobus III, leader of BakerHostetler’s privacy and data protection practice.
As noted in previous years, the Report emphasizes that entities need to be “Compromise Ready” by setting up defenses to lessen the number of incidents and having systems in place to respond – being cyber resilient – in order to reduce the risk of attacks and lessen their severity when they do occur.
“The stakes are higher than ever, but some entities still are not executing on the basics. Many have made great strides in their cybersecurity planning, but as threats evolve and entities change, they must also keep their security protocols current. It takes an ‘all-in’ approach from boards to senior management to entry level employees for best-in-class breach prevention and response planning,” Kobus noted.
Incident Causes
The Report shows that phishing remained the leading cause of incidents at 34 percent, followed by network intrusions at 19 percent, inadvertent disclosure (such as an employee mistake) at 17 percent and stolen or lost devices/records at 11 percent. A new category this year is system misconfiguration, which reflects instances where unauthorized individuals gain access to data stored in the cloud because permissions were set to “public” instead of “private,” and was responsible for six percent of incidents.
“Contrary to what some might expect, cloud security issues are not occurring because the cloud service providers are being compromised, but rather because of how the entity itself or its service provider configured access to the cloud instance,” added Kobus.
Increased Regulatory Scrutiny
Entities also need to be aware that regulators have become aggressive in investigating breaches, with upticks in not only the number of inquiries by regulators (i.e. 64 by state attorneys general and 43 non-AG investigations in 2017 compared to 37 state AGs and 29 non-AG investigations in 2016), but also in the speed by which they are being made. And when the General Data Protection Regulation (GDPR) and its quick notification and onerous financial consequences for non-compliance become effective on May 25, 2018 for entities established in the EU, the regulatory landscape will be even more challenging.
Response Timeline
One of the most important features of the Report is the incident response timeline, which identifies the four key time frames of the incident response lifecycle – detection, containment, analysis, and notification. This timeline gives entities context for understanding the timing of when they will have reliable information to facilitate communication about the incident.
Overall incident response times for 2017 were 66 days from occurrence to discovery (an increase of five days from 2016), three days from discovery to containment (an improvement of five days from 2016), 36 days from engagement of forensics team to investigation complete (four days faster than the previous year), and 38 days from discovery to notification (three days better than 2016).
Forensics Drives Key Decisions
In the data breach incidents analyzed in the Report, 41.5 percent employed the use of outside forensic investigators. The average cost of a forensic investigation was $84,417 in 2017 compared with an average cost of $62,290 in 2016. “The ability to quickly and efficiently conduct a forensic investigation is critical to helping answer essential questions about the incident, including: What happened? How did it happen? How do we contain it? Who do we need to inform? How can we protect affected individuals?” noted Kobus.
Other interesting trends/numbers from this year’s analysis include:
Compromise Response Intelligence
The Report provides a list of recommendations that entities can follow in order to help mitigate the opportunity for breaches to happen as well as to help lessen the severity of data breach incidents when they occur. The list, which includes suggestions from previous years that still hold true, has been updated to address issues/matters that have recently become prevalent. Some of the new headings address keeping data in the cloud, the increase in regulatory scrutiny, the need for entities to adopt multifactor authentication, and implementing a robust risk management program that incorporates complete buy-in from all levels of an organization.
Explore more articles in the Top Stories category
