The Computer Security Institute published its' latest annual survey on 12 March. Based on responses from 538 USA corporations and organisations, it found the costs of computer crime are still rising. 85% reported having a security breach in the previous 12 months, 186 of those were able to quantify the cost and reported $377,828,700 in financial losses. This was a 42% increase from last year, when 249 respondents reported only $265,589,940 in losses, or, in losses per respondent, a 90% increase.
The most serious losses were from theft of proprietary information (34 respondents reported $151,230,100) and financial fraud (21 respondents reported $92,935,500). 70% reported the Internet as a frequent point of attack, against only 31% reporting internal attacks to be frequent. On a positive note, more were reporting intrusions to the police: 36% against 25% in 2000 and 16% in 1996.
Many types of attack were on the rise, external penetration, DOS, employee misuse, and virus incidents. Virus incidents rose from 85% in 2000 to 94% in the latest report. Patrice Rapalus, CSI Director, commented: "The survey results over the years offer compelling evidence that neither technologies nor policies alone really offer an effective defense for your organization. Intrusions take place despite the presence of firewalls. Theft of trade secrets takes place despite the presence of encryption. Net abuse flourishes despite corporate edicts against it. Organizations that want to survive in the coming years need to develop a comprehensive approach to information security, embracing both the human and technical dimensions."
How important is this survey for organisations in Hong Kong? On one hand, it is a survey of a small number of organisations in a foreign country (very small, when you consider the size of the USA), so the accuracy and applicability of the statistics should be considered cautiously. On the other hand, the Internet knows no borders, and the general trends are confirmed by local surveys and reports.
The CSI Press Release and an application for a full copy of the survey can be found at the CSI website: http://www.gocsi.com/prelea_000321.htm