For IT managers fed up with constant patching, Australia's benchmark computer security survey has confirmed what almost all will already know: it's been another bumper year for worms.
Electronic attacks harming the confidentiality, integrity or availability of network data or systems based in Australia have continued to rise, with worms, viruses and Trojans again taking top ranking in this year's Computer Crime and Security Survey.
Compiled by AusCert, federal and state police forces and the federal Attorney General's Department, the survey — now in its third year — attempts to paint a broad picture of the state of computer security for organisations in Australia.
Figures from the survey reveal the number of organisations attacked has risen 7 percentage points (from 42 to 49 percent), along with a hike of 6 percentage points (from 70 to 76 percent) for organisations attacked between one and five times.
However, while the number of organisations attacked rose, the accompanying rise in the frequency of attacks appears to be confined to a few larger hits — almost certainly worms. Organisations suffering either more than six or 10 attacks declined marginally by 3 % for both.
Unsurprisingly, external attacks (88 percent) outnumbered internal attacks (36 percent), while the volume of external attacks actually dropped 3 % (from 91 to 88 percent).
AusCert director Graeme Ingram said the survey showed that although organisations were spending more money and were better prepared than ever in terms of security, the tide of malicious code was still rising faster than many organisations could cope with.
"It's like trying to stop a flood with a couple of sandbags. People are improving their game but the system is getting worse. Exploits of unpatched vulnerabilities (doubled from 29 to 60 percent). This is a major problem," Ingram said.
Australian High Tech Crime Centre head Alastair McGibbon said the figures showed electronic crime continued be a serious concern and was an evolutionary process which, like most other crime, moved to the next readily exploited target once shut down.
Probed about apparent lack of prosecutions over the increase of so-called 'phishing attacks' on bank Web sites, McGibbon argued that it was just as necessary to have strong protection for customers in the form of education as it was to mount prosecutions.
"It's about reducing the level of victimization. We have to have better enforcement but we also have to have better security. It's better to stop crime before it starts — that's a community approach," McGibbon said.
Other survey highlights for this year included: (all figures based on Australian reported results)
— denial of service attacks jumped by 7 %
— average cost of degraded network performance from heavy scanning soared from A$37,729 (US$26,380) to A$71,208
— sabotage of data networks fell from 4 to 2 %.
— theft or breach of proprietary information rose from 5 to 8 %, albeit off a small sample (8 responses). Average losses were placed at $A167,000, up from A$36,000, possibly skewed by one respondent filing a loss of A$500,000.
— computer facilitated financial fraud dropped from A$3.25 million to A$2.47 million.
— the number and cost of Web defacements appears to have dropped dramatically or people are not reporting them
— while the number of laptops stolen remained near constant, the total average annual losses actually declined.
— respondents declaring insider abuse of email or Internet all but dried up with the number of reports dropping from 30 to one, suggesting strong changes in the way such abuse is reckoned by organisations.