REPORTED FINANCIAL LOSS FROM CYBERCRIME ON THE RISE AGAIN
Just as the overall consensus was mounting that U.S. companies are doing better in protecting data, the 2007 CSI Survey revealed last month that the average annual loss reported by companies more than doubled, from $168,000 to $350,424. This ends a five-year run of lower reported losses.

Almost one-fifth of those respondents who suffered one or more kinds of security incident said they'd suffered a "targeted attack," which is defined as a malware attack in this survey, aimed exclusively at their organization or at organizations within a small subset of the general population.

Financial fraud surpassed virus attacks as the source of the greatest financial loss. Virus attacks had been the top runner seven years in a row and have now fallen to the number two spot. The CSI survey indicated that if separate categories concerned with the loss of customer and proprietary data are lumped together, then that combined category would be the second worst cause of financial loss. Another significant cause of loss was system penetration by outsiders.

For a number of years the trend has been moving to cybercrime that is more financially motivated. Robert Richardson, CSI director and author of the survey, conveys that “If targeted attacks are more successful and are perpetrated by criminals motivated by financial gain, then we'll expect to see a great many of these crimes noticed when organizations actually lose money to these attacks.”

Then there are, of course, the disgruntled employees, for whatever reason, who deliberately want to hurt the organization

where they work or are well-placed within the organization to gain access to critical data for profit. Insider abuse of network access or email edged out virus incidents as the most significant security risk according to the survey.

The survey also revealed that companies where incidents were detected tended to detect more of them than in previous years. For instance, those companies that detected more than 10 incidents jumped from 9 to 26 percent.

Security professionals need to pay attention and react to changing security threats in the wild and inside their organization. Richardson stresses that those responsible for computer security have to make their case within their respective organizations. They must not only be able to develop detailed business cases to justify new investments in technology to address the constantly changing threats, but in order to do so also understand the economic, financial, and risk management aspects of computer security.

If you would like a free consultation to review how NCX Group can help you identify your company's areas of risk, provide recommendations to achieve regulatory compliance and follow security best practices, or help with policies and procedures or security training, please contact us at 888-448-5451 or request a representative to call you.

---

NCX Group, Inc.
5000 Birch Street, West Tower, Suite 3000
Newport Beach, CA 92660
888-448-5451