Bangkok Post

January 26, 2000

SECURITY FOR ALL;
Computer crime survey

   A recent survey from New York-based firm Michael G. Kessler & Associates shows some interesting findings that we thought could be valuable information to readers. It found that of all the theft of proprietary information, 35 percent was due to malicious employees and only 28 percent due to hackers. The rest is stolen by other US companies (28 percent), foreign companies (11 percent) and governments (8 percent). The remaining 10 percent, according to the study, is listed as miscellaneous crimes. 

     The financial losses caused by these security compromises totaled $42 million last year, which is up more than 100 percent from the 1997 figure of $20 million. "It doesn't take a new millennium for corporate computer piracy to occur," said Kessler. "There's no such thing as a hacker's holiday. Internet invasions increase with growing computer and Internet popularity. "Codes can be cracked; systems will be sabotaged. Hacking is a reality, and CEOs who have turned a deaf ear to its existence will be shocked when it happens to their allegedly fail-safe network." The report estimates that for every break-in reported, 400 are not reported. Most companies fail to report computer break-ins for fear of bad publicity, and many times because they are not even aware of the intrusion. 

   The 1999 Computer Crime and Security Survey, based in San Francisco, polled 521 security professionals at corporations, government agencies and universities in the United States. The findings revealed that financial losses among 163 respondents totaled $124 million, which was the third straight year the survey had recorded losses greater than $100 million. System break-ins by outsiders were reported by 30 percent of respondents, and unauthorized access by insiders was reported by 55 percent. 

   Even though security measures, such as digital identification, encryption and intrusion detection systems, are being used more frequently, technology itself is obviously not enough to keep hackers at bay. 

   The lesson to be learned is simple: security technology does not equal a security program. Well-trained and motivated staff along with smart procedures are just as important for security as technology.

   Prepared by The Relay Group, specialists in data security consulting.