Uncertainty abounds

A PwC report on data breaches in UK organisations suggests businesses both large and small may need more help with information security, CRN finds

The number of cyber attacks on organisations by outsiders is growing - yet few organisations large or small are able to evaluate the effectiveness of the security measures they take. Those are the two main findings from the biennial PricewaterhouseCoopers (PwC) Information Breaches Security Survey 2012, based on 447 self-selected respondents polled in February and March this year.

“The vast majority of respondents had a security breach in the past year - 93 per cent of large organisations and 76 per cent of small businesses. The main cause is an increase in cyber attacks, especially for large organisations,” wrote PwC’s information security partner Chris Potter and IT risk assurance partner Grant Waterfall in the report.

The report was based on a poll by Infosecurity Europe which was analysed and written up by Potter and Waterfall. The duo wrote that the median number of “significant” attacks on each large organisation by an outsider in the past year was 54 - twice the number reported in 2010.

Fifteen per cent of large organisations had detected network penetration by a hacker in the past year, and 15 per cent of small businesses surveyed said they had suffered denial-of-service attacks during the previous 12 months.

“Large organisations are more visible to attackers. They also have more staff and more staff-related breaches. However, it is also true that small businesses tend to have less-mature controls, and so may not detect the more sophisticated attacks,” Potter and Waterfall wrote. “Malicious breaches affected a majority of respondents across all sectors.”

Security had not kept pace with the rapid changes to business practices and processes, especially with so many moving to the cloud. The survey indicated that 73 per cent of respondents had already outsourced business processes over the internet, and that 52 per cent of small businesses are now “dependent” on social networking sites (up from 32 per cent in 2010), according to Potter and Waterfall.

Failing to follow data protection laws

Forty-five per cent of large organisations had themselves breached the data protection laws, with 10 per cent of those breaching the law at least once a day, the pair added.

Twenty per cent of small businesses managed to lose confidential data, and 80 per cent of those breaches could be considered serious, according to Potter and Waterfall. “[Only] 18 per cent of organisations affected by data protection breaches had a contingency plan in place,” the duo added.

The worst security breaches of the past year cost large enterprises £110,000 to £250,000, and small businesses £15,000 to £30,000, according to the PwC report.

In the survey, 80 per cent of larger respondents did not assess the RoI on their information security investments, and 58 per cent of smaller companies failed to evaluate their security spend at all. Couple those figures with the rapid growth of mobile and consumer device use in the workplace, and a relatively small focus on allocating IT budget to security, and it is little wonder that data breaches may still be costing many businesses billions.

“Based on the number of breaches and the cost of the worst breaches, we estimate that the total cost of breaches has fallen somewhat from the 2010 peak, but is higher than 2008 levels (particularly for large organisations). Our best estimate of the total cost to UK plc is in the order of several billion pounds per annum,” Potter and Waterfall wrote. “No industry sector or location appears immune.”

Waterfall and Potter concluded that there is a strong correlation between the effectiveness of organisations’ contingency plans for information security and the seriousness of breaches. Despite an oft-reported sense of futility coupled with the difficulty of assessing the effectiveness of prevention, there remains some profit to be had from attempting to mitigate such threats.

“When contingency plans worked, fewer than half the incidents were serious. When the plans failed, four fifths were serious,” they wrote.

“Additional training is given with staff misuse or confidentiality violation and reconfiguration after hacks, malware infection or system failures.”

The most damaging breaches tended to be associated with hacker attacks, followed by fraud and loss of confidential data. Internet misuse and viruses tended to be more minor.

The pair also noted that the public sector, utilities and retailers more commonly suffered the most serious breaches, followed by travel, leisure and entertainment providers. “The worst security breaches are due to failures in people, process and technology,” the pair said.