Security costs CNII more

Computer crime cost survey respondents in Australia's private and public sector almost $16 million in 2004, according to this year's Australian Computer Crime and Security Survey.

Despite business' massive investments in security products and services, the cost incurred by viruses and other computer crime was 20 percent higher than 2003's figure -- an average of $116,212 per organisation -- the survey found.

Alarmingly, respondents that classed their organisations as part of the critical national information infrastructure (CNII) fared poorly as a percentage, registering more harmful attacks and higher losses overall compared to non-CNII organisations.

Although only 35 percent of respondents said they were CNII organisations, total losses from computer crime for CNII organisations was over $8 million, accounting for more than half (52 percent) of total losses for 2004.

The average financial impact of security breaches for CNIIs ($98,685) was almost double that of non-CNIIs ($56,531). And a greater percentage of CNIIs -- 50 percent -- reported experiencing at one or more additional harmful electronic attacks than non-CNIIs did.

The survey, conducted by Australia's Computer Emergency Response Team (AusCERT), was unveiled at its third annual Asia Pacific IT security conference AusCERT2004, held from 23-27 May, on the Gold Coast.

Survey author and AusCERT's manager analysis and assessment, Kathryn Kerr, said there could be variety of reasons for the poor results for CNII organisations. “Which reason is valid is speculation,” Kerr said.

One possible reason was that CNII organisations had better systems in place to detect and investigate attacks than CNII organisations. Another was that CNII organisations would be a more attractive target for attackers with malicious intent. Regardless of this, AusCERT's survey stated that the figures were “surprising”.

“It would be expected that CNII organisations would fare batter than other organisations because they should, arguably, be doing more to manage their higher risk,” the survey stated.

Siobhan Chapman travelled to AusCERT2004 on the Gold Coast as a guest of AusCERT.