State of the Practice of Computer Security Incident Response Teams ...

quantify the losses. Respondents who did quantify the losses reported a total of $202M, down
56% from the $455M reported in the 2002 survey. The 2003 CSI/FBI survey reported the
highest amount of (dollar) losses were caused by theft of proprietary information and denialof-service
attacks (total annual losses were about $70.2B and $65.6B, respectively). Virus
reports amounted to approximately $27.4B [Richardson 03].
Another survey, the Information Security Breaches Survey 2002 from the United Kingdom’s
Department of Trade and Industry (DTI), was conducted between November 2001 and mid-
January 2002. This survey reported that the costs associated with resolving computer security
incidents, as reported from participants in the survey, ranged from a lower limit of less than
(66% reporting) to an upper limit amounting to more than (4% reporting).
The average (mean) cost of a serious incident was reported as approximately [Potter
02].
The 2002 Australian/Deloitte Touche Tohmatsu/NSW survey was based on 95 responses from
public and private sector organizations (from a total of about 500). Their survey sought responses
on the following categories of incident activity:
• theft/breach of proprietary or confidential information
• unauthorized privileged access
• financial fraud
• telecommunications fraud
• sabotage of data or networks
• denial-of-service attacks
• degradation of network performance associated with heavy scanning 64
• wiretapping
• telecom eavesdropping
• virus/worm/Trojan horse infection
• laptop theft
• system penetration by outsider
• unauthorized access to information by insider
• insider abuse of internet access or email
64
Although not explicitly identified, the scanning referenced in this survey seems to indicate external
scanning against a respondent’s system(s) based on statements in the survey suggesting that
even if organizations have no vulnerabilities to exploit remotely, they still “experienced financial
losses due to network degradation associated with hacker scanning tools” [Australia 02].
CMU/SEI-2003-TR-001 61