Financial Damage Caused by Viruses

Damaging virus attacks are on the rise. The main reasons for this are the increased speed with which they are spread and their increasingly complex and hostile nature. More and more frequently, viruses use not only one, but several, mechanisms to spread. They use e-mail, web traffic (http) and Local Area Network (LAN) propagation to rapidly infect as many computers and systems as possible. At the same time, viruses cause financial damage by modifying and deleting files, sending out confidential information and making systems unavailable.

The risks described above can be managed when your and your business partners’ computer systems are properly protected from viruses. This is crucial, since computer systems are the backbone of our business infrastructure.

If a virus manages to become a disaster affecting several computers and systems, it can cause financial damage in several ways. These financial damages can be divided into direct and indirect costs.

The direct costs show up in the effort and time required to clean viruses from computers and systems, to re-install operating systems and other software, and to restore back-ups. However, the highest cost is found in lost productivity and the unavailability of computers and systems for business transactions.

The indirect cost of a virus disaster is much more difficult to estimate and verify. Indirect costs come from data loss, the leakage of confidential information, infecting customers and business partners with viruses, and, consequently, damage to a business’s reputation as well.

Fortunately, people and organizations appear to take virus protection seriously. Still, viruses manage to attack organizations as the study by ICSA Labs shows. In a 20-month period, within the 200 organizations surveyed, there were 113 virus attacks per 1,000 machines, per month. 28% of companies were hit with a virus "disaster," which was defined as affecting 25 or more servers or PCs. (Source: ICSA Labs, 2002; N=200 organizations (January 2000 – August 2001)

What is the direct cost of cleaning viruses from 25 computers? Below is a simplified theoretical calculation of potential costs.

• Assumption 1: Clean up is done by two IT professionals.
  
• Assumption 2: Clean up, restoring back-ups and verifying that computers are operational takes four hours per computer.
  
• Assumption 3: IT professionals work 16 hours per day fixing four computers simultaneously.
  
• Cost 1: The labor cost for fixing the computers is EUR 1,040 (assumed hourly rate is EUR 20)
  
• Cost 2: The total time that the computers are unavailable is 240 hours. If business is directly dependent on these computers, this means 240 hours of lost productivity and revenue-generating work product. With the revenue assumption of EUR 50 per employee per hour, this results in revenue losses of EUR 12,000.
  
• The total cost of the virus attack would be EUR 13,040.