A Look at the 2004 CSI/FBI Computer Crime and Security Survey Robert Richardson Editorial Director Computer Security Institute How to Use Statistics in Your Awareness Program:

Called the cops? Called the cops?

Respondents by Industry Respondents by Industry By industry sector : Figure 1 Utility 5% Manufacturing 12% Local Gov. 3% Other 19% Transportation 1% Telecom 2% Financial 19% Legal 1% Federal Gov. 7% State Gov. 3% Retail 3% Medical 6% High Tech 13% Education 7% High Tech 13%

Respondents by Employees Respondents by Employees By number of employees : Figure 2 1 – 99 19% 1,500 – 9,999 31% 50,000 or more 7% 10,000 – 49,999 14% 500 – 1,499 13% 100 – %

Respondents by Revenue Respondents by Revenue By revenue : Figure : 392 Respondents Under $10M 20% Over $1B 37% $100M – $1B 20% $10M - $99M 23% Under $10M 20% Over $1B 37% $100M – $1B 20% $10M - $99M 23%

Respondents Respondents

Called the cops? Called the cops?

Crime Reporting Crime Reporting

The Eternal Question The Eternal Question Can I use anything you just told me for my awareness program?

The Eternal Question The Eternal Question Can I use anything you just told me for my awareness program? Not exactly….

Types of attack by percent Types of attack by percent

Virus Insider Abuse Laptop/Mobile Theft

Statistics reduced to their essence…

Coffee Cup Deviation Coffee Cup Deviation Figure 15: dollar losses

Cybercrime Losses Cybercrime Losses Figure 15: dollar losses

Cybercrime Losses Cybercrime Losses Figure 15: dollar losses

Average Cybercrime Losses Average Cybercrime Losses

How to Use… How to Use… Average losses in a survey of about 500 security professionals were down for the third straight year. While this is good news (paying attention to security seems to reduce crime), it’s also true that identity fraud—the costs of which aren’t directly measured in this survey—are skyrocketing.

Tell a Credible Truth Tell a Credible Truth Be sure the base in survey statistics is justified Consider the magnitude of change arising from possible different interpretations of data

14) What is the total monetary value of losses your organization sustained due to electronic crimes or system intrusions in 2003? We do not track monetary losses due to electronic or related crimes (Base: 500) 32.4% (Base: 338) $100 million or more 0.3% $10 million to $99.9 million 2.4% $1 million to $9.9 million 5.0% $500,000 to $999, % $100,000 to $499, % Less then $100, % Don’t know/not sure 49.7% source: CSO magazine/U.S. Secret Service/CERT Coordination Center.

CSO/Secret Service/CERT Survey Mean $3,920,000 Median $100,000 Sum* $666,000,000 *Sum figure calculated using midpoints within each range. source: CSO magazine/U.S. Secret Service/CERT Coordination Center.

(Base: 338) $100 million or more 0.3%1 $10 million to $99.9 million 2.4%8 $1 million to $9.9 million 5.0%17 $500,000 to $999, %17 $100,000 to $499, %38 Less then $100, %89 Don’t know/not sure 49.7%168

(Base: 338) $100 million or more 1100,000,000 $10 million to $99.9 million 8439,600,000 $1 million to $9.9 million 17 92,650,000 $500,000 to $999, ,750,000 $100,000 to $499, ,400,000 Less then $100, ,450,000 Total:660,850,000 Don’t know/not sure 49.7%

(Base: 338) $100 million or more 1100,000,000 $10 million to $99.9 million 8 80,000,000 $1 million to $9.9 million 17 17,000,000 $500,000 to $999, ,500,000 $100,000 to $499, ,800,000 Less than $100, ,450,000 Total:213,750,000 Don’t know/not sure 49.7%

IT Budget Allocation IT Budget Allocation

Per Employee Per Employee

Tools & Technology Tools & Technology

Awareness Awareness

Financial Metrics Financial Metrics

Anecdotes Make Stats Real Anecdotes Make Stats Real The number of bot-infected computers declined from 30,000+ a day in July to an average of less than 5,000 a day by December, according to Symantec. (The Register) The [Honeynet Project] report pointed out that "more than one million hosts are compromised and can be controlled by malicious attackers" although it warned that this was a probable underestimate. The company also made an estimate as to the scope of distributed denial of service (DDOS) attacks. In the tracking period, from November 2004 to January 2005, Honeynet detected a staggering 226,585 IP addresses joining at least one of the channels being monitored. (Techworld.com)

Anecdotes Make Stats Real Anecdotes Make Stats Real an executive at a satellite TV firm in Massachusetts has been charged with hiring several botnets to disrupt the websites of three rivals, costing one of their web-hosting firms $1 million. (New Scientist.com)

Tie to Policy Tie to Policy Obviously, anyone acting like this executive would be dismissed and possibly criminally prosecuted Policies used to “lock down” systems are in part in place to prevent your system from becoming a “bot.” If your system is compromised, it may be used to perpetrate crimes.

Takeaways Takeaways Use believable stats – explain important elements such as sample skew Graphic representations of comparison stats are often easier to interpret

Takeaways Takeaways Keep it positive (for the most part) Relate statistics to anecdotes, then tie to policies.

Contact: Robert Richardson GoCSI.com

Contact: Robert Richardson GoCSI.com