The FBI and an information security industry association, the
Computer Security Institute (CSI), this week announced the results
of their seventh annual US Computer Crime and Security Survey.
Based on responses from 503 computer security practitioners in
US corporations, government agencies, financial institutions,
medical institutions and universities, the findings confirm that
the threat from computer crime and other information security
breaches continues unabated and that the financial toll is
mounting.
Highlights of the 2002 survey include:
- 90% of respondents (primarily large corporations and government
agencies) detected computer security breaches within the last
twelve months.
- 80% acknowledged financial losses due to computer
breaches.
- 44% (223 respondents) were willing and/or able to quantify
their financial losses. These 223 respondents reported $455,848,000
in financial losses.
- As in previous years, the most serious financial losses
occurred through theft of proprietary information (41 respondents
reported $170,827,000) and financial fraud (40 respondents reported
$115,753,000).
- For the fifth year in a row, more respondents (74%) cited their
internet connection as a frequent point of attack than cited their
internal systems as a frequent point of attack (33%).
- 34% percent reported the intrusions to law enforcement. (In
1996, only 16% acknowledged reporting intrusions to law
enforcement.)
Respondents detected a wide range of attacks and abuses. Here
are some examples of attacks and abuses on the rise:
- 40% detected system penetration from the outside.
- 40% percent detected denial of service attacks.
- 78%percent detected employee abuse of internet access
privileges (for example, downloading pornography or pirated
software, or inappropriate use of e-mail systems).
- 85% percent detected computer viruses.
- The survey also asked questions about e-commerce. Among the
results:
- 98% of respondents have web sites.
- 52% conduct e-commerce on their sites.
- 38% suffered unauthorised access or misuse on their web sites
within the last twelve months. 21% said that they didn't know if
there had been unauthorised access or misuse.
- 25% of those acknowledging attacks reported from two to five
incidents. 39% reported ten or more incidents.
- 70% of those attacked reported vandalism (only 64% in
2000).
- 55% reported denial of service (only 60% in 2000).
- 12% reported theft of transaction information.
- 6% reported financial fraud (only 3% in 2000).
A copy of the 25-page report can be accessed by completing a
form on the CSI’s
site
