Information security siege is taking its toll

In a report by PricewaterhouseCoopers (PWC) and CIO, entitled The Global State of Information Security 2005, more than 8,200 IT and security executives from 63 countries admit they have difficulties in managing data threats. These typically include the theft of personally identifiable records or intellectual property, corporate espionage, and traditional nuisances, such as spam and viruses.

In 2005 the number of incidents in connection with the infringement of information security increased by 22.4 percent in relation to 2004. Some 22 percent of the companies surveyed admitted that they have suffered financial losses as a result of such incidents, a serious increase on the seven percent who took the same hits in 2004.

 

Inside agents

Unsurprisingly, hackers are behind most of the malicious activity on the net (66 percent). Company owners should also be aware of the enemy within - current and former workers are responsible for 33 percent and 20 percent of all detrimental incidents, respectively. For the second year in a row, the most common type of attack on information security was malicious code, which in 2005 was behind 59 percent of attacks.

Companies are spending more and more to make their information secure. In 2004 IT security constituted 11 percent of companies' IT budgets, whereas last year this figure came to 13 percent. Surprisingly enough, as much as 40 percent of the 1,700 companies with $5 (zł.15.6) billion or more in revenues, said they did not know their information security budget.

"Companies very often make a mistake when they try to solve problems through adding more securing technology," said Mark Lobel, a security-focused partner at PWC. "An effective solution [is] creating a proper combination of people, processes and technologies." Currently, less than half of the companies surveyed employ a chief information security officer or a chief security officer. Only 37 percent of respondents have a ready security plan.

 

The broader view

The report shows that Poland's situation does not differ considerably from the global perspective, as far as information security is concerned. Jeremi Gryka, from PWC's audit and consultancy department, says that in Poland the bulk of information security executives work for smaller companies whose budgets cannot be compared with Western European entities.

"The differences result from the volume of our market. The differences in security budget volumes are more significant than the differences in the amounts spent on IT, and the prognoses in this respect are pessimistic," says Gryka. At the same time, he stresses, Poland experiences a similar number of security information incidents and, consequently, similar losses.

The scale of the problem is difficult to gauge, as most companies, fearing that their image could suffer, do not reveal their information security problems to the police.