1. CSI Survey 2007 Tiffany Gorman

2. Computer Crime and Security Survey
Significant rise in estimated losses due to cybercrime
Efforts in Cyber Security showing some return on investment
Longest running survey in information security field- 12 years
494 computer security practitioners responded of requests

3. Key Findings Average annual loss reported up to $350,424 from $168,000
18% suffered one or more targeted attacks
Financial fraud rose above virus attacks as source of greatest financial losses
Insider abuse of network access became most prevalent security problem
Reporting to law enforcement continued to increase

4. Issues
Virus pattern recognition software to identify threats with known signatures
Criminals more sophisticated
Criminals no longer motivated by “glory”, but by financial gain
Malware signature detection less effective
Simply not paying attention

5. Issues Financial losses are estimates Down time difficult to predict
IT Security not limited to technology; includes Audit and Legal Departments

6. Business Justifications
61% of respondents allocated <5% of IT budget to information security
Training of employees responsible for sensitive information
Security Awareness training <1% of budget
ROI, NPV, and IRR necessary for mgmt approval

7. Frequency, Nature, and Cost of Breaches
Less frequent, but cost more
Small percentage attributed to insiders (<20%)
Total losses: $66,930,950
Financial Fraud= #1 $21,124,750
Virus= #2 $8,391,800

8. Effectiveness of Security
Anti-Virus Software
Firewall
VPN
Internal Security Audits
Penetration Testing
External Security Audits

9. Actions Following Incidents
Attempted to ID perpetrator
Patch security holes
Install security patches
Install additional security software
Report to law enforcement
WHY NOT???? #1 Reason

10. Summary Trend of reduction of losses couldn’t continue
Networks and operating systems complexity
Cybercrime and ID theft reduce consumer confidence
Move toward identity management
Educate computer security professionals

11. QUESTIONS????