WASHINGTON DC – U.S. companies are reporting that their average financial loss from cybercrime has doubled from $168,000 to $350,424 after a five-year run at lower reported losses, the Computer Security Institute reports in its 2007 Computer Crime and Security survey.

Financial fraud, such as payments of fraudulent invoices, overtook virus attacks as the source of the greatest financial loss. Virus losses, which had been the leading cause of loss for seven straight years, fell to second place. Another significant cause of loss was system penetration by outsiders.

“We are starting to see a shift that cybercrime is increasingly financially motivated,” said Robert Richardson, CSI director and author of the survey. “Viruses, while it is costly to an organization that has to deal with it, does not line the pockets of the guy that created the virus.”

Almost one-fifth of those respondents who suffered one or more kinds of security incident said they’d suffered a “targeted attack,” i.e. a malware attack aimed exclusively at their organization or at organizations within a small subset of the general population.

When asked generally whether they’d suffered a security incident, 46 per cent of respondents said yes, down from 53 per cent last year and 56 per cent the year before.

Other findings of the CSI survey noted that insider abuse of network access or e-mail (such as trafficking in pornography or pirated software) edged out virus incidents as the most prevalent security problem, with 59 per cent and 52 per cent of respondents reporting each respectively.

To help reduce financial loss, Richardson said that there are traditional security measures like firewall and anti-virus scanners that still have an important role to play in security but are less effective to some of the new threats.

“The next phase is going to have to deal with two areas, one is identity management and the other is better protection of databases that store things like customer information,” he added.

For example, Richardson explained that there is going to be a shift to different kinds of encryption in order to protect data better if it happens to be stolen or loss. On the identity management side, a scenario needs to be created where if somebody does something wrong, organizations have a reliable way to track and see who exactly is doing it and reliably match user login to a real world identity. “This is a disincentive to criminals because they are more likely to get caught.”

If there was one thing that Richardson hopes people take away from the survey is that he stressed that the face of cybercrime is changing to a more malicious, financially driven and harder to detect framework.

“In other words it is not good news. If you look at our surveys over last few years, losses have gone down significantly [but] we are simply not going to sustain that.”

This column was written by Vanessa Ho of ConnectIT

a>>