2010/2011 Computer CrIme and SeCurIty Survey - Gatton College ...

2010 / 2011 CSI Computer Crime and Security Surveylowest it’s ever been. We don’t think there’s enough data to state an exact number or to claim thatthis sort of number is gospel, but we do think it’s suggestive.One other thing: we do believe that not being able to offer an overall average loss figure leavesa bit a hole in our industry’s understanding of what happens to average enterprises who suffermoderate sorts of incidents. Some better accounting (and we really do mean accounting) needsto occur.The CSI survey historically has also asked respondents to estimate what percentage of monetarylosses were attributable to actions or errors by individuals within the organization (Figure 11). Aswe’ve noted in prior reports, much is made of “the insider threat,” but this threat really rolls up twoseparate threat vectors, on the one hand those posed by malicious employees, and on the otherthose who have made some kind of unintentional blunder. Beginning last year, we asked surveyrespondents to specify between malicious insiders and non-malicious insiders.Last year, 43.2 percent of respondents stated that at least some of their losses were attributableto malicious insiders, but non-malicious insiders were clearly the bigger problem, with 16.1 percentof respondents estimating that nearly all their losses were due to non-malicious actors. Morebroadly, non-malicious insiders were clearly responsible for more loss than malicious ones, buteven more to the point, there was clearly a great deal of loss that was not due to insiders at all.FIGURE 11None Up to 20% 21 to 40% 41 to 60% 61 to 80% 81 to 100%Malicious insider actions 59.1% 28.0% 5.3% 0.8% 3.8% 3.0%Non-malicious insider actions 39.5% 26.6% 6.5% 8.9% 4.0% 14.5%This year’s data is consistent with last year’s. In keeping with the notion that more than half oflosses are not due to malicious insiders, the percentage of respondents reporting no losses dueto malicious insiders edged up to 59.1 percent.87.1 percent of respondents said that 20 percent or less of their losses should be attributed tomalicious insiders. 66.1 percent of respondents said that 20 percent or less of their losses wereattributed to non-malicious insiders.For a long time it was something of an old chestnut among security professionals that mostbreaches were perpetrated by insiders. The CSI survey never showed results that supported thisview, but particularly in the past couple of years, following some rewording of the survey instrumentto clarify the responses, we’ve taken the view that external attackers accounted for at leasthalf of the damage done. This year we are quite confident that internal actors are responsible for20