Lessons from the Third Annual E-Crime Survey

CSO's annual e-crime poll, conducted in conjunction with Carnegie Mellon University's CERT

By Derek Slater

October 01, 2006 — CSO —

CSO's annual e-crime poll, conducted in conjunction with Carnegie Mellon University's CERT

Coordination Center and the U.S. Secret Service, with underwriting by Microsoft, shows some signs of

progress this year in the battle against electronic crime and also unearthed some other useful data

points.

1. Overall status: Progress to report

A whopping 69% of respondents said they feel their organization is better prepared this year to prevent

cybercrime than it was last year.

Electronic crime is clearly widespread; whether it's growing or not is less clear. More people report a

declining number of security events. However, a larger number than that36 percent of this

year's respondentssay they're still seeing an increase.

2. The cost of crime: Getting a clue

Respondents indicated that operational losses (system downtime, lost productivity) are the most

common consequence of e-crime. However, they also indicate some progress toward being able to

quantify the financial impact. Last year, more than six out of 10 respondents said they "don't know"

their total financial loss to e-crime; this year, that percentage is down to half the group.

3. Outsider vs. Insider: The correct answer is "both"

Where do e-crimes come from? We get a lot of press releases that start off by observing that insider

crime is overlooked. And others that say outsider crime is actually much more significant. The bottom

line is that, while the percentages fluctuate each year, any CSO or CISO who doesn't actively build

protections against both sources of e-crime is out to lunch.

4. Reporting reticence: It's not what you think

The widespread assumption is that people don't pursue criminals because they want to stay out of the

headlines. The data suggests instead a failure of forensics.

If any e-crimes were not referred for legal action, please indicate the reason(s) they were not

referred.

5. What works: Getting beyond the baseline defense

The survey also asked respondents about the effectiveness of various security technologies and

• Print