Computer breaches: losses up, reporting down. (Tech Talk).

The results of a computer crime survey conducted jointly by the Computer Security Institute and the FBI show that both the frequency of computer attacks and the losses arising from those security breaches are increasing.

Of the 503 respondents, 90 percent reported a computer security breach, and quantifiable losses almost quintupled from their level in 1997; they now total more than $455 million. More than half of those losses stemmed from the theft of proprietary information and financial fraud.

The respondents, who were information security managers from a wide range of industries and from the government, also claimed losses of more than $50 million from "insider abuse of Net access," almost $50 million lost from viruses, and more than $11 million lost in laptop thefts.

Even more alarming, according to some experts, is that only 34 percent of the companies that suffered a breach reported it to law enforcement--down from 36 percent the previous year. This lack of reporting hamstrings law enforcement efforts to track down and prosecute wrongdoers, says Alan Frill, senior managing director of Kroll Worldwide.

"The theory is that the only way to know [that] an attack is being planned...is by seeing unusual patterns, and those patterns won't be seen by government unless [incidents] get reported," says Brill.

The reasons companies fail to report incidents are varied. Dorsey Morrow, CISSP, general counsel for the International Information Systems Security Certification Consortium, or [(ISC).sup.2], says that intrusions go unreported due to fears of damaging the company s reputation, concerns about exposing the company to lawsuits, and a reluctance to tie up personnel or equipment during an extended investigation. The survey showed that IT managers are reluctant to reveal breaches even within their own companies. Only 19 percent reported intrusions to the company's general counsel, making it impossible to prosecute offenders through civil complaints, says Frill.

Marc Goodman, senior managing director of digital security and investigations at Decision Strategies, says that infosec professionals don't always recognize the need to reveal attacks to the company's lawyers. "Many system administrators and IT personnel don't know that what has occurred is indeed a criminal event," he says.

Morrow believes that the increase in breaches indicates that information security is not yet considered a vital corporate issue by senior managers. As a result, he says, "they don't push down the policies and procedures that need to be put into, place."

Protection policies, such as encrypting data on laptops taken outside the corporation and regularly updating antivirus signatures, don't get much notice outside the IT department, notes Morrow. "Senior management bas to take a bigger role in leading the way for the rest of the corporation," he says.

Experts are quick to point out that the survey's results are merely broad indicators of the impact of computer breaches. CSI's editorial director, Richard Power, notes in his introduction to the survey that the numbers only represent "raw intelligence" that "should not be used as a basis to extrapolate some pie in the sky numbers on intrusions or financial losses for the whole economy or the whole of the Internet."

Brill says, however, that he finds the survey interesting because it does tend to accurately show trends. @ Find out more on the survey by visiting www.securitymanagement.com.