DTI survey finds lots of work to do

Fewer than two thirds of UK websites that accept financial data for sales transactions encrypt the information to protect customers, according to the Department of Trade and Industry's 2006 Information Security Breaches Survey.

The survey of 1,000 UK companies found that, while over two thirds of large organisations encrypt customers' financial details, fewer than a third of smaller companies did so.

"It is encouraging that companies recognise the value of secure e-commerce to their business, but some still have work to do to put secure controls in place to satisfy their customers," said Andrew Beard, the director from PricewaterhouseCoopers leading the survey.

"Somewhat worryingly, the number of attacks on websites is rising, and half of the attacks reported by respondents were described as 'serious'."

The survey found that the number of attempts to steal financial information is growing steadily. Over a quarter of those attacked indicated that they are suffering a 'significant attack' every day.

"E-commerce provides infinite opportunities for UK businesses, but also provides opportunities to criminals targeting business networks for financial gain," said Ed Gibson, chief security advisor at Microsoft UK.

"Online transactions can be secure with the right levels of protection, and as long as organisations and end users use security best practice and the technology tools available to them.

"The survey highlights that, although progress is being made, UK businesses still need to regularly review and reassess their security status to continue to increase customer confidence online."

Wi-Fi is one of the major attack vectors used and the survey found that the number of unprotected networks had halved since 2004. However one in five firms still lacks any Wi-Fi security controls.