Based on responses from 503 computer security practitioners in US corporations, government agencies, financial institutions, medical institutions and universities, the findings confirm that the threat from computer crime and other information security breaches continues unabated and that the financial toll is mounting.
Highlights of the 2002 survey include:
- 90% of respondents (primarily large corporations and government agencies) detected computer security breaches within the last twelve months.
- 80% acknowledged financial losses due to computer breaches.
- 44% (223 respondents) were willing and/or able to quantify their financial losses. These 223 respondents reported $455,848,000 in financial losses.
- As in previous years, the most serious financial losses occurred through theft of proprietary information (41 respondents reported $170,827,000) and financial fraud (40 respondents reported $115,753,000).
- For the fifth year in a row, more respondents (74%) cited their internet connection as a frequent point of attack than cited their internal systems as a frequent point of attack (33%).
- 34% percent reported the intrusions to law enforcement. (In 1996, only 16% acknowledged reporting intrusions to law enforcement.)
Respondents detected a wide range of attacks and abuses. Here are some examples of attacks and abuses on the rise:
- 40% detected system penetration from the outside.
- 40% percent detected denial of service attacks.
- 78%percent detected employee abuse of internet access privileges (for example, downloading pornography or pirated software, or inappropriate use of e-mail systems).
- 85% percent detected computer viruses.
- The survey also asked questions about e-commerce. Among the results:
- 98% of respondents have web sites.
- 52% conduct e-commerce on their sites.
- 38% suffered unauthorised access or misuse on their web sites within the last twelve months. 21% said that they didn't know if there had been unauthorised access or misuse.
- 25% of those acknowledging attacks reported from two to five incidents. 39% reported ten or more incidents.
- 70% of those attacked reported vandalism (only 64% in 2000).
- 55% reported denial of service (only 60% in 2000).
- 12% reported theft of transaction information.
- 6% reported financial fraud (only 3% in 2000).
A copy of the 25-page report can be accessed by completing a form on the CSI’s site