Are cloud security tools worth the investment? Determining if any security tool is worth the cost can be tough because proving return on security investments isn’t easy. While time-saving efficiencies, such as single sign-on tools, are relatively simple to quantify, it is far more challenging to calculate the amount of money saved by a preventative measure.

There’s also the perception factor. Specifically, we notice what impacts us directly, and the avoidance of a breach doesn’t feel like a tangible impact even though it is a very positive one.

So are those cloud security tools worth it? Of course, it depends on a number of factors, including the type of tools, how they’re configured and how they’re implemented. But looking at data from the Ponemon Institute’s “2016 Cost of Data Breach Study” might give us some general insights.

Some Tools Pay for Themselves

The annual report quantifies the economic impacts of data breaches and observes cost trends over time. Understanding the real costs of these breaches and learning which tools and processes helped companies keep recovery costs down can provide hard-dollar inputs to professionals planning and optimizing their security programs.

This year’s report showed that certain tools, such as encryption and data loss prevention (DLP), could bring significant cost savings: $13 and $8 per record, respectively. Consider an example company that has deployed encryption extensively, then suffered a midsize breach of 50,000 lost records. Using study data, the use of encryption saves an average of $650,000. If the total cost of the encryption tools was under $650,000, they paid for themselves; if it was significantly under $650,000, they may have saved the company a large chunk of change.

Identifying the Right Cloud Security Tools

The report also identified areas that negatively impacted the recovery costs post-breach. The two most expensive factors were third-party involvement, which increased the cost by $14 per record, and extensive cloud migration, which increased the cost by $12 per record.

Let’s go back to the company that lost 50,000 records but decreased its recovery cost by $650,000 because it had deployed encryption. If that same company had extensively migrated to cloud, using the numbers from the study data, we can calculate that they’d have increased the recovery cost by $600,000 for that breach.

Is $12 the Whole Story?

Twelve dollars is not the whole story. Although it’d be neat and pretty to draw a straight line between survey data and real-world savings, the reality isn’t quite as simple. The Ponemon number is an excellent data point to consider, but it’s an aggregate based on all the survey respondents. Each company would need to answer another set of survey questions to hone in on the specifics of the breach as it relates to recovery cost and cloud adoption, such as:

  • Was the cloud itself the cause for the increased cost?
  • Was data breached from the cloud or from an on-premises source?
  • Was it a public, private or hybrid cloud?
  • Was the company using SaaS, IaaS or PaaS?

The inability to make a perfect, laser-focused prediction, however, doesn’t mean the $12 number isn’t valuable to consider; it absolutely is. It highlights that cloud adoption impacted data breach costs — there was a cost, and it was a fairly significant one on a per-record basis.

Apply Best Practices to the Cloud

So how can we extend data protection to our cloud deployments and, hopefully, drive down the cost of a data breach? Going back to the report, a few notable tools and practices brought down the cost of breach recovery, such as use of encryption, DLP and data classification.

These aren’t surprises: All of those are common elements of a strong data protection program. But failure to extend data best practices to the cloud may be leading to the cloud tax on data breach costs. If you’re not meeting or exceeding all of your data protection levels in your cloud environment, you’re putting the data at unnecessary risk.

Is Cloud Security Worth It?

Do data protection and controls for on-premises data extend explicitly to the cloud? Have you undertaken self-examination and analysis to determine if that is the case? Are you encrypting the cloud data at rest? Are you managing access to cloud data?

If your answers aren’t coming up yes, price out the cost of a solution such as encryption or a cloud access enforcement tool. If you can implement those solutions for less than $12 a record, there’s a good chance they’ll be paying your organization back not just in a better data protection posture and compliance readiness, but also in the unfortunate event of a breach. That, for most organizations, makes cloud security tools that protect data worthwhile indeed.

Read the complete 2016 Ponemon Institute Global Cost of a Data Breach Study

More from Cloud Security

How Posture Management Prevents Catastrophic Cloud Breaches

We've all heard about catastrophic cloud breaches. But for every cyberattack reported in the news, many more may never reach the public eye. Perhaps worst of all, a large number of the offending vulnerabilities might have been avoided entirely through proper cloud configuration. Many big cloud security catastrophes often result from what appear to be tiny lapses. For example, the famous 2019 Capital One breach was traced to a misconfigured application firewall. Could a proper configuration have prevented that breach?…

How to Implement Cloud Identity and Access Governance

Creating identity and access governance across cloud environments is crucial for modern organizations. In our previous post, we discussed how important human and non-human identities are for these environments and why their management and the governance of their access can be difficult. In the face of these challenges, our cloud identity and access governance (CIAG) approach offers an orchestration layer between cloud identity and access management (IAM) and enterprise IAM, as the following graphic shows. As we continue our CIAG…

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Why Are Cloud Misconfigurations Still a Major Issue?

Cloud misconfigurations are by far the biggest threat to cloud security, according to the National Security Agency (NSA). The 2022 IBM Security X-Force Cloud Threat Landscape Report found that cloud vulnerabilities have grown a whopping 28% since last year, with a 200% increase in cloud accounts offered on the dark web in the same timeframe. With vulnerabilities on the rise, the catastrophic impact of cloud breaches has made it clear that proper cloud security is of the utmost importance. And…