Computer attacks down, security survey says

While the cost of fending off hackers appears to be dropping for U.S. companies, attacks that involve unauthorized access to information are becoming much more costly, according a survey recently published by the Computer Security Institute and the FBI.

The survey, which included about 700 respondents from the government and a variety of industries, found that average losses related to computer attacks dropped by 61% in 2004. On average, companies say computer and network attacks cost them $204,000 last year, down from an average of $526,000 in 2003. The report did not explain how specific factors, such as loss of employee productivity or security consultant fees, contributed to these costs.

This marks the fourth consecutive year that this number has declined, says Robert Richardson, report co-author and editorial director of CSI, an association of computer and network security professionals in San Francisco.

Part of the reason for the drop is that companies have become better at protecting themselves, Richardson says. "For your run-of-the-mill virus , your average organization has that under control," he says. "There's a very fast reaction on the part of anti-virus vendors, and there are automated pathways to update the virus data on enterprise networks."

However, the cost of information theft jumped considerably in 2004. "To some degree, the heat of hacker activity has moved to identity theft," Richardson says.

The survey found that the average net loss attributable to unauthorized information access increased from more than $51,000 in 2003 to more than $300,000 last year. Attacks that resulted in the theft of proprietary information cost companies more than $355,000 on average in 2004, up from $169,000 the previous year.

CSI's survey was done in conjunction with the San Francisco division of the FBI's Computer Intrusion Squad.

Given the demographics of the survey's participants, it's not surprising that they're suffering less damage from attacks. "We ask people who care about security," Richardson says. "They care enough [about security] to be members of a professional organization, so my hunch is they're trying to get better at security."