Survey Reveals Call for Global Law Enforcement To Fight Against e-Crime

Mumbai — An international survey of 107 security professionals conducted by Websense at this year’s e-Crime Congress reveals a quarter of respondents believe the arrest and jail sentence for the CEO or Board member responsible would be a fitting punishment for a serious company data breach that exposes consumers’ confidential data. Only 3% did not believe there should be any legally enforced punishment. Seventy nine percent of respondents believe companies experiencing serious breaches should be fined and 59% feel compensation should be given to consumers affected. Respondents almost unanimously (96%) called for an enforcing body that obliges global governments to work together to address cybercrime.

Other survey results:

• Stakeholder Pressure to Prevent Data Loss: Compared with one year ago, 79% of respondents believed the average organisation is now under more pressure from stakeholders to introduce additional measures to protect against data loss. Key factors driving this include:
  
  
  • Securing the company brand (51%)
    
  • External pressure from data loss being reported in the media (56%)
    
  • Personal data security (42%)
    
  • Affect on share price of a security breach (34%)
  
  
• Responsibility Lies with CEO or Board: An almost unanimous view (95%) amongst respondents that the Board or CEO should be held accountable for a security breach with 26% of these respondents believing the CEO should take ultimate responsibility. This indicates a marked change in opinion compared with the 2007 survey that found 74% of security professionals believed the Board should be responsible. Last year, 21% found the IT department ultimately responsible and in 2008 this number has reduced to just 5%.
  
• Reactive Security at Board-level: Just over three quarters (76%) of respondents thought the average company continues to take a reactive approach to security at Board-level despite the view that the Board should be accountable for security breaches.
  
• Data Loss Prevention Not a Priority: Respondents believed the top reasons for companies not taking action against data loss was cost (45%) and not putting the protection of their confidential data as a high enough priority (45%). Other reasons included:
  
  
  • Would not take action until legally required 22%
    
  • Too complicated 21%
    
  • Belief that no action is needed (9%)
  
  
• Need for Security Standard To Aid Consumer Trust: 91% of survey respondents believed the introduction of a recognised security standard would inspire increased consumer trust in company brands.

“This survey indicates a strengthening opinion for action to be taken against cybercrime and data loss on a broader scale than ever before. We do expect to see more stringent regulation for security breaches, including those that involve the loss of personal data. Board members should ensure proactive, strategic action is taken to protect their organisation’s essential information from emerging Web-based and e-mail borne security threats and data loss to prevent sensitive information getting into the wrong hands,” said Mark Murtagh, technical director EMEA and APAC, Websense.

The sample size of this international survey was 107 respondents from 15 countries. All respondents were amongst the delegates who attended the e-Crime Congress on 5 and 6 March 2008. These included security professionals from government and public and private sector organisations, as well as senior managers charged with responsibility for risk, audit and compliance.