75% of Enterprises Have Suffered Cyber Attacks, Costing $2M+ On Average

coomaria writes "OK, even allowing for the fact this comes from a newly published study (PDF) from a security company, that's still one heck of a statistic. The fact that it's Symantec, and so has access to perhaps more enterprises than most, makes it a double-heck with knobs on. Or how about this one for size: 'every enterprise, yes, 100 percent, experienced cyber losses in 2009.'"

Comments

Full Text

[Archon-X]

'Article' is at best 3 paragraphs, poorly written, with advert popups.
For those who are interested, original text below.

Wow. That's quite a statistic, but there it is in front of me jumping off the pages of the latest global State of Enterprise Security study from Symantec. The two lines shining so brightly and grabbing my attention read "75 percent of organizations experienced cyber attacks in the past 12 months" and "these attacks cost enterprise businesses an average of $2 million per year". I'll say it again, wow!

Maybe that is not so surprising when you consider that the report states that every enterprise, yes 100 percent, experienced cyber losses in 2009. The top three losses being intellectual property theft, customer credit card data theft and the theft of other personally identifiable customer data. These losses translated into a financial cost 92 percent of the time mainly in terms of productivity, revenue, and tanking customer trust.

Of course, as I have said before the math is always hard on the brain when you read these reports. That 75 percent figure is revealed immediately after we are informed that apparently 42 percent of organisation consider that security is the number one consideration for their business, beating off competition from such things as natural disaster and terrorism and traditional crime. In fact, it is a bigger concern than all three of those things combined. The disparity between the two could, of course, be partly down to another revelation in the report: enterprise security is becoming more difficult due to understaffing, new IT initiatives that intensify security issues and IT compliance issues.

When it comes to understaffing, network security is the biggest problem for 44 percent of those responding, with endpoint security sharing the honours also on 44 percent. There there are the initiatives that IT rated as most problematic from a security standpoint include infrastructure-as-a-service, platform-as-a service, server virtualisation, endpoint virtualisation, and software-as-a-service. And not forgetting compliance, with your typical enterprise having to explore no less than 19 separate IT standards or frameworks and employ around eight of them.

"Protecting information today is more challenging than ever" said Francis deSouza, senior vice president, Enterprise Security, Symantec Corp. "By putting in place a security blueprint that protects their infrastructure and information, enforces IT policies, and manages systems more efficiently, businesses can increase their competitive edge in today's information-driven world."

Advertising as journalism, on slashdot

[Jawn98685]

Sorry guys, but this crap is a complete waste of my time.

I'd be surprised if it's anything less than 100%

[jimicus]

I seriously doubt Symantec are only counting "concerted attacks from a single original with a specific target in mind". More likely they mean "opportunistic attacks".

So, to /., I say:

• Raise your hand if your company consists of more than a handful of people.
• Keep your hand up if your company has an internet connection.
• Keep your hand up if you roll out managed AV software to all desktops and monitor it religiously (including checking for PCs which haven't been seen in a while).
• Keep your hand up if every PC and every server has a full-blown firewall running locally which blocks all incoming traffic except for what you know for a fact you need.
• Keep your hand up if you filter spam (either yourself or through a third-party service).
• Keep your hand up if your filter successfully excluded 100% of all phishing and trojan-link-spreading emails over the last year.
• Keep your hand up if your web access is filtered on a default-deny basis (ie. staff can only access pre-approved sites).
• Keep your hand up if your web access is through a proxy which blocks the download of executables, ActiveX, Adobe PDFs, encrypted files (who knows what's in them?) and JavaScript.
• Keep your hand up if you update all your PCs (including laptops, even if offsite) within 24 hours of the discovery of any security flaws in client software.
• Keep your hand up if your switches only allow connections from pre-allowed MAC addresses.
• Keep your hand up if you have done all of the above and still your staff are happy with the service you provide and don't try and work around you at every opportunity.

Those of you who still have your hand up, well done. You've done just about all that is possible to secure your network short of giving everyone dumb terminals and your internal customers are delighted with everything you do.

Everyone else will see an attack from time to time. The whole point of a of security is you have several layers so any attack won't get far.

Re:I'm shocked

[Dunbal]

Unless you have data which shows something to the contrary, don't dismiss it out of hand, just like you (clearly) don't accept it on their word.

      On the contrary, we live in an age where moral decadence is rampant even among professionals. Where well known drug companies create sock puppet "peer reviewed" magazines, with the sole purpose of "publishing" favorable studies for their drugs. Where "climate experts" leave out any inconvenient truth that contradicts the trend they are trying to "prove". Where "expert witnesses" in court turn out to be frauds and lie under oath.

      No, today is a time when you must especially dismiss reports like this out of hand. And there are several reasons:

      I doubt the CEO of any company would proudly announce how much money his company "lost" due to "cyber-attack" (yes look at us we're vulnerable/we're idiots!). It's none of Symantec's business.

      Their categories are meaningless. Please explain the difference between Cyber-attacks, "Traditional criminal activities" and (of course it had to be there) "terrorism"? These are all separate categories according to their survey. Apparently 10% of all companies surveyed have been the victims of "terrorism". This does not correlate well with, say, the evening news.

      They claim that on average companies are losing $2 million per year EACH. Yet the majority of companies (71%) are experiencing "no cyber attacks" or "just a few cyber attacks". Clearly these tiny attacks must be devastating.

      Another section claims that 29% of respondents claim "significant" or "slight" increase in "attacks" in the past year. What they leave out is that this means 71% of respondents think there is "no increase" or some sort of "decrease". Oops.

      Frankly, if you don't know how to think, you get swindled by lies like this. Symantec is out to sell "security" and in order to do that, they are willing to make you think that they are the only ones who can prevent your business from being ruined ($2 million dollars/year/large enterprise, or at least that's how they want it to sound) and that you are surrounded by enemies.

Re:Original report...

[codegen]

Brand related risk is risk to your reputation that damages your "Brand". They are talking about enterprise level IT. So you are working for some large company such as WalMart or Microsoft or IBM. Examples might be defacing the website, or stealing customer information. A more subtle attack may be to change the price in a database indicating a sale that doesn't really exist. Too many customers buy the product and you have to backtrack on the price and cancel orders. This would damage your reputation. Or many others... Of course, the implication is that Symantec Security products would prevent such events.