Survey: Security Complacency Rising Among Execs

The results from the fourth annual CSO “E-Crime Watch Survey” are a mixed bag of positive developments and troubling trends. While the overall threat level from Internet crime has held steady, security executives are actually becoming more complacent about dealing with it.

The survey, which was conducted in conjunction with Microsoft, the U.S. Secret Service and Carnegie Mellon Software Engineering Institute’s CERT Program, polled 671 law enforcement officials and security executives on a variety of security topics. Fifty-seven percent of respondents cited e-crime as a risk they are increasingly concerned about. And while 69 percent of respondents said they are more prepared to deal with e-crime threats now, they are also spending less on it. The study shows that IT security spending this year fell by 5 percent and corporate security spending by 15 percent. Dawn Cappelli, senior member of the technical staff at CERT, chalks that up to reduced security budgets and the current nature of attacks. “The types of attacks we saw last year were outside and untargeted, like viruses, worms and spam. Since people now know how to deal with those e-crimes, they aren’t feeling as threatened.”

But that may be false confidence. Insider threats are still rising. Study participants identified the top three sources of insider e-crime as social engineering (45 percent, up from 38 percent last year), compromised accounts (39 percent), and copying information to USB drives or other mobile storage devices (36 percent). Despite the increasing risk of insider crime, only 57 percent of respondents conduct employee background checks. down from 73 percent last year. The number of companies conducting employee security awareness training also plummeted—from 68 percent last year to 38 percent this year.

Respondents still identified firewalls as the most effective technology to prevent e-crime, which can leave companies vulnerable, says Jeff Jones, director of trustworthy computing for Microsoft. “Too much confidence in a traditional firewall can make companies more vulnerable to new types of insider and targeted attacks designed to bypass the perimeter.”

While the study found that insider and outsider threats cause similar amounts of damage (insiders 34 percent, outsiders 37 percent), Cappelli says that doesn’t mean they pose the same risks. “Outsider threats are untargeted and handled well by technology. But insider threats are targeted, and much harder to stop. Given that statistic, organizations need to be more concerned about insiders.”