Security Attacks and Breaches on the Rise

Published: September 27, 2007

by Timothy Prickett Morgan

Two reports by organizations that track attacks on corporate networks released last week will probably not make network and security administrators sleep any better. But, given all of the malware, worms, and other nasty stuff out there in the electronic world, they probably were going to sleep with one eye open and one hand on the BlackBerry anyway.

The Computing Technology Industry Association (CompTIA) recently commissioned a survey of IT organizations to try to find out how severe the security breaches they are seeing in their systems are. The severity level is on the rise, according to those companies survey. On a scale of 0 to 10, where 10 is the most severe level of breach, the level in 2005 was 2.3 and in 2006 was 2.6. But in the 2007 survey, the level jumped to 4.8, on average. Small, medium, and large enterprises report approximately the same frequency of breaches, and smaller companies tend to have slightly less severe breaches. Still, the point remains that companies all of sizes and IT persuasions are being cracked open by various kinds of malware and human mistakes.

"This suggests that while the number of security breaches has stabilized, the breaches that are occurring are having a greater impact than ever on organizations," said Brian McCarthy, chief operating officer at CompTIA.

Across all companies, the average cost of dealing with a security breach was $369,388, with a number of large companies with breaches that cost more than $10 million a pop bringing up the class average. About half of the respondents to the CompTIA survey said that the security breaches they have experienced in the past year cost $10,000 or less. Averaged across all respondents, lost employee productivity accounted for 35 percent of costs, with server or network downtime representing 21 percent of costs, and lost revenue-generating activity being about 20 percent of the cost associated with a breach. Legal fees and fines represented 8 percent of costs, and 17 percent of the cost was related to dealing with damage to physical devices and other assets. Nearly a quarter of the companies surveyed by CompTIA that had a security breach in the past year were inside jobs. Which just goes to show you that a firewall is not enough security.

The other interesting report to come out relating to hack attacks last week came from IBM's Internet Security Systems, which put out its X-Force malware report for the first half of 2007. Based on an analysis of over 210,000 malware samples from that time, the volume and sophistication of malware attacks is on the rise.

In fact, says IBM, the number of unique malware attacks in the first half of the year now exceeds the number that Big Blue monitored for the whole of 2006. Trojan horse malware--files that look legitimate but which have been compromised by hackers--account for 28 percent of the volume of malware so far this year; last year, downloaders--a small program that gets onto a machine so it can later go get the real malware and download it--were the most popular piece of malware being passed around the Internet.

The good news is that the number of vulnerabilities reported in operating systems, routers, and other gear has dropped a bit. IBM says that it identified 3,273 vulnerabilities in the first half of this year, down 3.3 percent from the same six months in 2006. The IBM X-Force team has catalogued over 33,000 vulnerabilities to date. If you want to get more detail on the X-Force report, follow this link.

RELATED STORIES

MPack Hacker Tool Claims 10,000 Compromised Web Sites

Security Still an Issue in 2007 for System i5 Shops

Security Experts Say Botnets, Web Extortion Threats on the Rise

SQL Injection Attacks Being Used by Hackers for Profit

More Than Half of Tech Companies Report Security Breaches

                     Post this story to del.icio.us
               Post this story to Digg
    Post this story to Slashdot