AUSTRALIA DATA SECURITY Not only does cyber crime pay, but it pays very well - Security - Technology:

Not only does cyber crime pay, but it pays very well

Julia Talevski
June 16, 2009

SECURITY breaches have caused small to medium businesses to fork out more than $600 million in 2007, according to a report from the Australian Institute of Criminology.

The latest report, titled The Australian Business Assessment of Computer User Security (ABACUS), was based on a national survey of about 4000 businesses, which showed 13 per cent of small businesses, 20 per cent of medium businesses and 30 per cent of large organisations had been affected by a security breach.

The principal criminologist at AIC, Russell Smith, says it's the largest survey of businesses done in Australia that looks at computer crime issues.

The survey estimates the cost of security incidents on Australian businesses was between $595 million to $649 million, with some of the biggest security breaches caused by virus attacks and malicious software such as spyware and keylogging, which captures a user's keystrokes. Smith says at least 44 per cent of businesses were victims of that kind of breach.

The third most prevalent was phishing attacks, where fictitious websites are used to capture account information. Smith says phishing was involved for about a quarter of businesses that suffered attacks.

Close to nine per cent of businesses experienced actual theft of hardware such as notebooks and mobile phones.

"That's an important problem because they've got a lot of data recorded on them that could have databases of client information and other personal details," Smith says.

The survey estimates the average loss for small businesses was about $360 an incident and up to $18,000 for large organisations.

"The largest loss on one business was $600,000," Smith says. "The retail sector suffered the highest losses."

Throughout the country, businesses spend about $1.95 billion on security tools. The survey indicates 85 per cent of them have some sort of anti-virus software.

"The expenditure depends on the size of the business," Smith says. "With small business you would expect that they spend a lot less, at $992 each year, right up to $38,000, which was the average for large businesses.

"It raises an interesting issue of small businesses probably not doing as much as they should in terms of looking after themselves with computer security."

Questions were also raised about how much people knew about IT and computer security. Large businesses had the most knowledge and expertise, while small businesses didn't have many computer security skills, so were more vulnerable.

"More needs to be done to educate businesses; manufacturers of software and hardware also need to make systems easy to use in terms of IT security," Smith says.

Small businesses should at least ensure their organisation is secure by having the most up-to-date security systems and virus protection. Smith advises that if you have problems, ensure IT security people get involved so that you don't experience the same security breach in future.

On top of that, he says businesses that use wireless network systems should ensure they're configured properly.

"You need to find out what's happened and you need to clean up the mess before it happens again," Smith says. "There's a lot of re-victimisation that takes place among businesses."