Home » Data Protection » Malware/Cybercrime

Lessons from the Third Annual E-Crime Survey

CSO's annual e-crime poll, conducted in conjunction with Carnegie Mellon University's CERT

» add a comment

By Derek Slater

October 01, 2006 — CSO —

CSO's annual e-crime poll, conducted in conjunction with Carnegie Mellon University's CERT

Coordination Center and the U.S. Secret Service, with underwriting by Microsoft, shows some signs of

progress this year in the battle against electronic crime and also unearthed some other useful data

points.

1. Overall status: Progress to report

A whopping 69% of respondents said they feel their organization is better prepared this year to prevent

cybercrime than it was last year.

Electronic crime is clearly widespread; whether it's growing or not is less clear. More people report a

declining number of security events. However, a larger number than that36 percent of this

year's respondentssay they're still seeing an increase.

Did the total number of security events experienced by your organization during

the last year increase, decrease or remain the same when compared to the prior 12 months?

Year td>	width="33%"> 2006	width="33%"> 2005	width="33%"> 2004
width="33%">Increase	width="33%"> 36%	width="33%"> 35%	width="33%"> 43%
width="33%">Decrease	width="33%"> 20%	width="33%"> 13%	width="33%"> 6%
width="33%">Remain the same	width="33%"> 28%	width="33%"> 30%	width="33%"> 23%
(Dont know)	width="33%"> 16%	width="33%"> 22%	width="33%"> 28%

2. The cost of crime: Getting a clue

Respondents indicated that operational losses (system downtime, lost productivity) are the most

common consequence of e-crime. However, they also indicate some progress toward being able to

quantify the financial impact. Last year, more than six out of 10 respondents said they "don't know"

their total financial loss to e-crime; this year, that percentage is down to half the group.

Which of the
following types of losses did your organization experience during the past 12 months as a result of e-
crime?
(base: experienced a crime)

Operational losses
td>

width="33%">
63%
Financial
losses
width="33%">
40%
Harm to
reputation
width="33%">
23%
No
applicable losses
width="33%">
13%

(multiple responses possible)

Estimate the total financial loss:

width="33%">

2006

width="33%">2005

Dont

know

width="33%">

50%

width="33%">62%

3. Outsider vs. Insider: The correct answer is "both"

Where do e-crimes come from? We get a lot of press releases that start off by observing that insider

crime is overlooked. And others that say outsider crime is actually much more significant. The bottom

line is that, while the percentages fluctuate each year, any CSO or CISO who doesn't actively build

protections against both sources of e-crime is out to lunch.

What percent of e-

crimes suffered by your organization are known or suspected to have been caused by&

	width="33%"> 2006	width="33%"> 2005	width="33%"> 2004
width="33%">Outsiders	width="33%"> 58%	width="33%"> 80%	width="33%"> 71%
width="33%">Insiders	width="33%"> 27%	width="33%"> 20%	width="33%"> 29%
width="33%">Dont know	width="33%"> 15%	width="33%"> n/a	width="33%"> n/a

4. Reporting reticence: It's not what you think

The widespread assumption is that people don't pursue criminals because they want to stay out of the

headlines. The data suggests instead a failure of forensics.

If any e-crimes were not referred for legal action, please indicate the reason(s) they were not

referred.

Damage
level insufficient to warrant prosecution
bgcolor="#cccccc" width="33%">
54%
width="75%">Lack of evidence/not enough info to prosecute
bgcolor="#cccccc" width="33%">
48%
width="75%">Could not identify the individual(s) responsible for committing the crime
bgcolor="#cccccc" width="33%">
34%
width="75%">Concerns about negative publicity
bgcolor="#cccccc" width="33%">
11%
width="75%">Prior negative response from law enforcement
bgcolor="#cccccc" width="33%">5%

5. What works: Getting beyond the baseline defense

The survey also asked respondents about the effectiveness of various security technologies and