The average cost of a serious information security breach is œ30,000, according to the Department of Trade and Industry?s (DTI) Information Security Breaches Survey 2002.
The average cost of a serious information security breach is œ30,000, according to the Department of Trade and Industry?s (DTI) Information Security Breaches Survey 2002. Several companies reported incidents costing them more than œ500,000. Three-quarters of UK businesses believe that they hold sensitive or critical information, but only one quarter have a security policy in place to protect it. Information security issues have never been higher on the board agenda, say the firms behind the survey – RSA Security, Symantec, Genuity and Countrywide Porter Novelli, led by PricewaterhouseCoopers. Three-quarters of UK business identified info-security it as a high priority for senior management (compared to half in 2000). However, such pledges do not tally with practice; the number of UK businesses suffering a malicious security incident since 2000 has almost doubled. Half of companies (four out of five large businesses) fell victim over the past year to viruses, hacking attacks, fraud, and other information security breaches compared to one quarter in 2000 and less than one in five in 1998. The survey claims that UK businesses are not spending anywhere near enough to protect their business on-line. Only one quarter of firms spend more than one per cent of their IT budget on security (three to five per cent is acknowledged as the minimum reasonable level, rising to an average of 10pc in high-risk sectors such as financial services). The main reason for the lack of investment in security measures appears to be a failure to recognise the economic return. Less than one third of businesses ever evaluate the return on investment on their security expenditure.
