We live in a time of unparalleled technological change. When the telephone was introduced in 1876, it took 71 years before it could be found in more than half of all households. Personal computers, introduced in 1975, took 23 years to achieve the same level of penetration. The latest developments are now taking less than a decade to go from ‘state of the art’ to commonplace.
For the business community, technological change provides new opportunities. It also creates new risks that need to be managed if companies are to take advantage of those opportunities. The Internet is a good example of this.
Over the past decade, new technology has changed the way that business is conducted. E-mail has largely replaced the fax for business communications, while 88 per cent of UK businesses now have a broadband connection to the Internet. According to the IMRG 2006 E-Retail Annual Report, retail website revenues over the Christmas 2005 holiday period reached GBP5bn in the UK, and online revenues will this year account for 10 per cent of total retail sales. And it’s not just retail. The March 2006 Confederation of British Industry (CBI) financial services survey shows that, on average, 16 per cent of customers use the Internet for transactions.
There has been some disruption to the status quo as a result of new technology though. Some established high street players have already suffered as customer-buying patterns have changed. Others are discovering an increased dependence on technology; only one in six small businesses could continue their operations without their IT systems. And, importantly, the adoption of new technology brings with it associated information security risks.
The Department of Trade and Industry (DTI) information security breaches survey, published every two years, is the largest and most authoritative survey of UK companies’ experience in this area. The 2006 survey, which was recently published, provides an insight into the issues organisations are facing and the techniques they are using to protect themselves. So, what does the survey reveal?
Survey Findings
First, and most importantly, three-quarters of UK businesses rate security as a high or very high priority for their senior management or board of directors. The priority is consistent across all sizes of company. Companies that are heavily dependent on their IT systems are nearly twice as likely to assign a high priority to security as those that do not. This is broadly consistent with the pattern seen since the turn of the century. What is different, however, is that this priority now seems to have triggered a change in the level of action.
UK companies are spending more on information security controls than ever before, on average 4-5 per cent of their IT budget, up from 3 per cent in 2004 and 2 per cent in 2002. Given that the total UK IT spend is roughly GBP75bn, this means that UK companies are spending around GBP3bn a year on their information security. The main drivers for information security expenditure are still confidentiality, integrity and availability; 90 per cent of businesses rate these as important. Protecting customer information and compliance with the Data Protection Act are seen as increasingly important. Enabling business opportunities and improving efficiency tend to be less significant; in fact, 30 per cent of businesses do not consider these to be important.
Increased expenditure on security controls is leading to greater adoption. For example, three times as many companies have a security policy as did six years ago, almost every organisation backs up its critical data and three-quarters store these back-ups offsite. 98 per cent of businesses now have anti-virus software, four-fifths of firms update their anti-virus signatures within a day and 88 per cent install critical operating system patches within a week. UK businesses appear to believe that the extra investment in security is worthwhile; three-quarters of them are confident or very confident that they have identified all significant security breaches in the last year.
The investment appears to be paying off. Fewer companies had security incidents than in 2004 when the DTI survey was last undertaken. Overall, 62 per cent of businesses have had a security incident in the past year, down from 74 per cent two years ago. Large businesses continue to be more security-conscious and they have reaped rewards as the total cost to them of security incidents has fallen by 50 per cent over the past two years. However, it is important not to get carried away by the apparent good news. While the number of companies affected by security incidents has decreased since 2004, it is still twice the level a decade ago.
The burden of security incidents is increasingly falling on small businesses where security controls tend to be less well developed. The average number of security incidents increased by 50 per cent to about eight a year. The average cost (principally business disruption cost rather than cash losses) of a UK company’s worst security incident was approximately GBP12,000 – up from GBP10,000 two years ago. Overall, an indicative estimate of the total cost of security breaches to UK companies has increased by 50 per cent from two years ago, and is around GBP10bn a year.
The gap between companies that are focused on information security and those that are not is widening. Approximately half of all UK businesses have security policies and carry out risk assessment on information security. However, while the rest may have anti-virus controls, they lack basic security disciplines and may be over-confident about the effectiveness of their security controls. Two-fifths of companies still spend less than 1 per cent of their IT budget on information security. There is a correlation between security expenditure and those firms that perform risk assessments. On average, those that carried out a risk assessment spent 7 per cent of their IT budget on security. The average expenditure for those that did not was only 4 per cent. It seems likely, therefore, that those that have not assessed the risks are under-investing in their security.
Importance of Risk Assessment
Risk assessment has never been more important, given the ever-increasing pace of technological change. Today’s emerging technologies include wireless networking, instant messaging and voice over Internet protocol (VoIP) telephony. Each of these is changing the nature of the security threat UK businesses face.
Unfortunately, companies seem slow to adopt controls to reduce the threats that emerging technologies pose. A quarter of UK businesses are not protected against spyware. Although more wireless networks are protected than two years ago, one in five is still completely unprotected and a further one in five is unencrypted. Fifty-five per cent of firms have not taken any steps to protect themselves against the threat posed by removable media devices. Two-fifths of companies that allow staff to use instant messaging have no controls in place over its use. Of the companies that have implemented VoIP, half did so without evaluating the security risks.
No Time for Complacency
Given the security threats today, it is clearly not a time for complacency. At the DTI survey launch, Alun Michael, minister of state for industry and the regions, referred to a ‘tipping point’ between two generations of problems. He went on to comment that UK plc may now have got on top of the problems of the late 1990s, when the authors of worms and viruses came close to gaining the upper hand, but that it is clear that we are now at the start of a much darker era when the ‘movers and shakers’ are a part of organised crime.
Companies seem to recognise the threats in this changing and more sinister environment. Nearly two-thirds of UK businesses believe there will be more security incidents in the next year than in the last and also believe it will be harder to detect security breaches in the future. In contrast, only one in five is optimistic about the future outlook. This pessimism is consistent with the view that UK businesses are winning yesterday’s battles, but are not preparing the foundations for defeating a more technology-focused form of guerrilla warfare.
Guidelines on Protection
So what can companies do to protect themselves in this changing world? The DTI survey makes five key recommendations:
1. Draw on the right expertise and international standards to understand the security threats you face and your legal responsibilities.
2. Integrate security into normal business practice, through a clear security policy and staff education.
3. Use risk assessment to target your investment in security controls in the areas of maximum business benefit.
4. Make sure your key security defences are up to date and integrated, and address emerging technologies you are exposed to, such as spyware, instant messaging and voice over IP.
5. Develop contingency plans so that you can respond to any security incidents efficiently and minimise business disruption.
These recommendations have not changed since the last survey. Basic security practices are just as relevant today as they were a decade ago. However, there are two major areas where the 2006 survey recommendations have been enhanced.
First, international standards on information security have developed over the past two years, and those UK companies that have adopted them report significant benefits as a result. Secondly, the 2006 survey has emphasised the importance of adopting an integrated risk-based approach to information security, including consideration of emerging technology. Without this, UK businesses are likely to become increasingly exposed in tomorrow’s security landscape.