Cybercrime threats posed to targeted organizations are increasing faster than many organizations can combat them, a recent survey has revealed. Moreover, the survey suggests the threat of cybercrime is heightened by current security models that are only minimally effective against cyber criminals.
The 2010 CyberSecurity Watch Survey uncovered a drop in victims of cybercrimes (60 percent compared to 66 percent in 2007), however, the affected organizations have experienced significantly more attacks than in previous years.
Between August 2008 and July 2009 more than one third (37 percent) of respondents experienced an increase in cybercrimes compared to the previous year. While outsiders (those without authorized access to network systems and data) are the main culprits of cybercrime in general, the most costly or damaging attacks are more often caused by insiders (employees or contractors with authorized access). One quarter of all cybercrime attacks were committed by an unknown source.
Although the number of incidents rose, the ramifications have not been as severe. Since 2007, the average monetary value of losses resulting from cybercrimes is revealed to have declined by 10 percent. This can likely be attributed to an increase in both IT security spending (42 percent) and corporate/physical security spending (86 percent) over the past two years.
The survey indicates that as technology advances, so do the methods to commit cybercrimes. Outsiders invade organizations with viruses, worms or other malicious code, phishing and spyware, while insiders most commonly expose private or sensitive information unintentionally, gain unauthorized access to/use of information systems or networks and steal intellectual property.
More than half of the respondents (58 percent) believe they are more prepared to prevent, detect, respond to or recover from a cybercrime incident compared to the previous year. However, only 56 percent of participants have a plan for reporting and responding to a cybercrime.
The public may not be aware of the number of incidents because almost three-quarters (72 percent), on average, of the insider incidents are handled internally without legal action or the involvement of law enforcement. However, cybercrimes committed by insiders are often more costly and damaging than attacks from outside.
The 2010 CyberSecurity Watch survey was conducted by CSO magazine in cooperation with the U.S. Secret Service, Software Engineering Institute CERT Program at Carnegie Mellon University and Deloitte.