Feeds

Soaraway security spending keeps breaches in check

UK.biz yet to plug leaks

The Power of One eBook: Top reasons to choose HP BladeSystem

The average spending by companies on information security defences has tripled over the last six years, resulting in the overall cost to UK business of reported security breaches dropping by a third.

According to the latest edition of the UK government-sponsored Information Security Breaches Survey, the number of companies reporting a security breach has returned to roughly the level last seen in 2002, after reaching a peak in 2004.

Most firms that experience breaches encounter multiple problems. The average cost of the worst incident of the year tends to be dependent on the size of the business, varying from roughly £15,000 for small businesses to £1.5m for very large firms.

Expenditure on information security has increased from two per cent to seven per cent of the IT budget on average over the last six years. But this increase in spending is uneven with a significant minority (21 per cent) of companies spending less than one per cent of their IT budget on information security.

Nonetheless, the security landscape has improved markedly over that period with 94 per cent of wireless networks now encrypted, versus only 47 per cent in 2002. More than half (55 per cent) of UK companies have a documented security policy, versus 27 per cent in 2002. Two in five businesses provide ongoing security awareness training to staff – twice as many as six years ago.

Despite the improvements in security controls, the survey shows that many companies remain exposed to loss of confidential data. For example, four-fifths of companies that had computers stolen have not encrypted their hard drives, and two-thirds of companies do nothing to prevent confidential data leaving on USB sticks, for example.

Despite the increased use of encryption, 13 per cent of firms surveyed said they have detected unauthorised outsiders within their network. A significant minority (six per cent) reported that they had suffered a confidentiality breach. Worse still, one in ten websites that accept payment details do not encrypt them, according to the survey.

The 2008 Information Security Breaches Survey (ISBS) was carried out by a consortium, led by PricewaterhouseCoopers, on behalf of the Department for Business, Enterprise & Regulatory Reform (BERR). The survey, which is carried out every two years, was launched on Tuesday at the Infosecurity Europe conference in London.

Chris Potter, the partner at PricewaterhouseCoopers who led the survey, said businesses are beginning to talk a good security game but are failing to follow it up with actions in many cases. "There are still some fundamental contradictions. Some 79 per cent of businesses believe they have a clear understanding of the security risks they face, but only 48 per cent formally assess those risks.

"Also, 88 per cent are confident that they have caught all significant security breaches, but only 56 per cent have procedures to log and respond to incidents. The survey also shows 71 per cent have procedures to comply with the Data Protection Act, but only eight per cent encrypt laptop hard drives," he added. ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.