The Irish Chapter of the Irish Information Systems Security Association and University College Dublin’s Center for Cybercrime Investigation recently released the results of the first comprehensive survey on the impact on cybercrime on companies and organisations in Ireland, the Irish CybercrimeSurvey 2006. 

This is a significant event for those of us working in the Information Security field within Ireland as up until now we have depended on surveys from other sources such as the annual CSI/FBI Computer Crime and Security Survey, Ernst & Young’s Survey or others provided by vendors such as Symantec’s Internet Security Threat Report.  While all these surveys provide valuable information and insight into the upcoming trends and issues we should be aware of, they provided very little hard facts that we could use to convince Irish senior management to invest scarce Euros into information security initiatives.

The main problem being many companies that take part in the above surveys are much larger than those here in Ireland thus undermining any like for like comparisons.  The argument is further weakened when the figures for items such as the average costs of security breaches are quoted in US dollars as the listener immediately thinks this is not relevant to them.

The Irish Cybercrime Survey now provides us with hard data that is relative and pertinent to the Irish IT environment and will hopefully act as a wakeup call to business people who think their company is too small to be a target of cybercrime.

Some key statistics that got our attention were;

• 98% of all organisations were impacted by cybercrime
• 90% impacted by computer virus infection
• 20% suffered losses > €100,000
• 33% suffered losses > €50,000
• 52% had incidents resulting in 10 man days to recover
• 25% had incidents resulting in 50 man days to recover
• 55% lost data as a direct result
• 90% suffered loss in productivity
• 12% of internal misuse resulted in criminal cases

Well done to the ISSA and UCD and hopefully next year’s survey will show a reduction in some of those headline figures.