By 
According to a recent Kaspersky report, ‘How businesses can minimise the cost of a data breach’, enterprises in the META region with outdated technology can lose 16% more money when they suffer a data breach compared to those who update everything in a timely manner. For small and medium-sized businesses, the difference is even starker – up to 54% globally. The problem of obsolete and unpatched software is quite common and important for businesses to address, since half of organisations in the META region (55%) use at least some form of out-of-date technology in their infrastructure.
While vulnerabilities are inevitable in any software, regular patching and updates can minimise the risk of exploitation. That’s why users are always advised to install the latest software versions as soon as they are available, even if these updates can sometimes be difficult or a time-consuming task for organisations. With many businesses having at least some form of outdated technology (55%), Kaspersky’s survey shows that organisations should prioritise renewing software and be prepared to invest because doing so could save them money in the long-term.
If a data breach happens, enterprises in the META region with any form of outdated technology, including unpatched operating systems, old software and unsupported mobile devices, can suffer an additional $158k in financial damage, taking losses to a total of $1.152m. This is 16% more than the cost for companies with completely updated technologies ($994k). As for small and medium-sized businesses, they can lose an additional $33k. The total cost rises to $122k – 36% more compared to $89k for businesses with all required updates installed.
Average cost of a data breach depending on whether the company has outdated technology
Among the reasons given for not updating technologies, the most commonly reported in the META region is that some line employees refuse to work with new software and devices, so an exception was made for them (54%). Other reasons include: in-house apps that cannot run on new devices or operating systems (48%), as well as they belong to C-level staff and we exclude them from our update plan (44%).
“Any additional costs for business are of course critical, especially now. The global economic situation is unstable because of the pandemic and investments in IT and IT security are predicted to decrease. This is why in the latest ‘IT Security Economics’ report we wanted to explore how businesses can reduce the burden in case of a cybersecurity incident. It offers strong reasoning why the issue of obsolete software is so important. Even if it is impossible to get rid of it overnight, there are still some measures to mitigate the risk. Companies can not only save money, but also avoid other potential consequences – which is crucial for any business,” comments Sergey Martsynkyan, Head of B2B Product Marketing at Kaspersky.
In order to save money and minimise the risk of data breaches as a result of software vulnerabilities, Kaspersky suggests the following measures:
- Ensure the organisation is using the latest version of its chosen operating systems and applications, with auto-update features enabled so that the software is always up to date.
- If it is not possible to update software then organisations are advised to address this attack vector through smart separation of vulnerable nodes from the rest of the network, along with other measures.
- Enable the vulnerability assessment and patch management feature in an endpoint protection solution. This can automatically eliminate vulnerabilities in infrastructure software, proactively patch them and download essential software updates.
- It is important to boost security awareness and practical cybersecurity skills for IT managers, as they are at the frontline of IT infrastructure updates. A dedicated Security for IT Online training course can help.
- For critical IT or operational technology systems, it is important to always be protected regardless of any available software updates. This means they should only enable activity that is predetermined by the purpose of the systems. KasperskyOS supports this concept of cyber-immunity and can be used to build IT systems that are secure by design.
Kaspersky’s report, ‘How businesses can minimise the cost of a data breach’, is the second part of the IT Security Economics 2020 series and is available here. To read the first part, ‘Investment adjustment: aligning IT budgets with changing security priorities’, please download it from the Kaspersky IT Security Calculator web page.
