PwC found that the average cost of each serious breach is
£30,000, and several companies reported incidents costing them more
than £500,000.
The survey, which claims to be the most comprehensive survey on
information security in the UK to date, was conducted by PwC, the
world’s largest professional services organisation, in conjunction
with RSA Security, Symantec, Genuity and Countrywide Porter
Novelli.
It shows that three-quarters of UK businesses believe that they
hold sensitive or critical information, but only one-quarter have a
security policy in place to protect it. Three-quarters of UK
businesses identified information security as a high priority for
senior management (compared to half in 2000). However, PwC found a
clear disconnect between this and actual practice.
The number of UK businesses that have suffered a malicious
security incident since 2000 has almost doubled. Half of companies
(four out of five large businesses) fell victim over the past year
to viruses, hacking attacks, fraud, and other information security
breaches, compared to one quarter in 2000 and less than one in five
in 1998.
The survey also shows that UK businesses are not spending
anywhere near enough to protect the business that they are doing
on-line. Only one quarter spend more than 1% of their IT budget on
security. According to PwC, 3-5% is acknowledged as the minimum
reasonable level, rising to an average of 10% in high risk sectors
such as financial services.
The main reason for the lack of investment in security measures
appears to be a failure to recognise the economic return. Less than
one third of businesses ever evaluate the return on investment on
their security expenditure.
The 2002 DTI Information Security Breaches Survey was
commissioned to encourage the boards of UK businesses to take
effective action to protect their competitiveness and
profitability. The survey was conducted between October 2001 and
January 2002 and involved 1,000 telephone interviews, 100 face to
face interviews and answers to an on-line questionnaire. The full
results of this sixth, biennial survey will be published at
Infosecurity Europe 2002, a London event, on 23 April.
A four-page executive summary of the 2002 survey and the
detailed technical report of the 2000 survey are available at
www.security-survey.gov.uk
