Money lost to cybercrime down--again
Survey findings that threat-related losses are dropping seem at odds with frequent doom-and-gloom headlines.
For the fourth straight year, the financial losses incurred by businesses due to incidents such as computer break-ins have fallen, according to the 2006 annual survey by the Computer Security Institute and the FBI. Robert Richardson, editorial director at the CSI, discussed the survey's findings in a presentation at the CSI NetSec conference here Wednesday.
Respondents in the 2005 survey reported an average of $204,000 in cybercrime losses, Richardson said. This year, that's down to $168,000, about an 18 percent drop, he added. Compared with 2004, the average loss is down 68 percent.
"How do you go about reconciling the sense of things getting worse with the respondents who are saying they are losing less money?" Richardson asked. The 2006 survey, a final version of which is slated to be released next month, could provide some answers.
Most important, perhaps, the 615 U.S. CSI members who responded to this year's survey reported fewer security incidents. Viruses, laptop theft and insider abuse of Net access are still the most reported threats, but all have decreased compared with last year.
"The danger of insiders may be somewhat overstated, according to the survey group," Richardson said. About a third of respondents said they had no losses at all due to insider threats, another 29 percent said less than one-fifth of overall losses came from insider threats.
Consistent use of security technology may also contribute to the improvements, with essentially all of the respondents stating that they use firewall and antivirus software, not much of a change from last year. This year, eight out of 10 said they also use spyware protection, a category not listed a year ago.
"Overall, you have a picture that is pretty good in many ways," Richardson said. "We're seeing fewer of some of the attacks that have been such a plague for us in many years, and respondents are using less and less money."
That "less money" may be good for companies, but not for security vendors. It refers to the percentage of IT budgets spent on security. In the 2006 survey, nearly half of the respondents said less than 2 percent of the budget is spent on security. Last year that percentage was 35 percent.
When it comes to cybercrime losses, consumers might be bearing the brunt of them, and they are not covered by the survey, Richardson suggested. "Consumers are the low-hanging fruit," he said. Costs related to identity theft, for example, fall largely back onto the consumer, he added, even if it did start with a data breach at an enterprise.