March 18, 2009

Survey suggests economy could lead to cybercrime increase

Led by antivirus software giant McAfee Inc., the study, titled "Unsecured Economics: Protecting Vital Information," found that companies lost an estimated $4.6 billion in intellectual property last year as a result of cybercrime. It warns that the global recession could push those numbers even higher.

The study will provide a basis for a panel discussion at Purdue's Center for Education and Research in Information Assurance and Security's 10th annual symposium Tuesday (March 24) and Wednesday (March 25). The discussion will be 9:45 a.m. Wednesday, and for more information on the symposium visit https://www.cerias.purdue.edu/site/symposium2009

McAfee looked to the center -- also known as CERIAS -- to conduct the study. The center is based on bringing researchers together with commercial, nonprofit and government organizations that have an interest in information security. In this case, the researchers were a pair of Purdue faculty in management.

"CERIAS involves various disciplines in research programs that are driven by real problems," said Eugene H. Spafford, the center's executive director. "We were able to match experts in different areas to the research that McAfee needed."

The researchers surveyed chief information officers of about  800 companies in the United States, the United Kingdom, Germany, Japan, China, India and Brazil.

Karthik Kannan and Jackie Rees, professors of management in Purdue's Krannert School of Management, helped put together a 25-question survey. Vanson Bourne, a company in England, provided mailing and translation services.

"This was the first true global report on the security of digital intellectual property," Rees said. "A lot had been done previously, but very piecemeal and incrementally. This survey focused on information security, but with the idea that intellectual property from the business and commercial perspective is critical. Our intent was to assess and understand the nature of the problems, and we found that not everyone is operating on the same level."

McAfee announced the findings on Jan. 29.

Among the researchers' findings:

* Cyberthieves have moved beyond basic hacking and stealing credit card data and personal credentials. An emerging target is intellectual property.

* More and more vital digital information, such as intellectual property and sensitive customer data, is being lost in the transfer between companies and continents. The average company has $12 million worth of sensitive information residing abroad.

* The global economic crisis is poised to create a "perfect storm" in information security risks as companies face increased pressures to reduce spending and cut staff. That has the potential to lead to more porous defenses and increased opportunities for cybercriminals. Forty-two percent of respondents interviewed indicated that laid-off employees are the biggest threat caused by the economic downturn.

"Many firms are moving sensitive information and data across borders," Kannan said. "This study provides insights into what risk factors firms consider as important when moving the data.  The study also raises public policy questions about how countries should respond in order to improve their perceptions. This is the first study to focus on perceptions of the firms regarding various countries."

CERIAS has worked with McAfee on previous projects and is routinely involved with the business world through its Industry Partners program. The program involves 13 companies and organizations that help fund the center. Those partners can access CERIAS research, get information from a wide variety of areas and get an early hiring advantage from a pool of Purdue graduate students who will soon hit the job market.

"The students who go through the CERIAS program are attuned to industry's issues because their education involves real-world experiences," Spafford said. "The opportunities in this growing field are reflected in our enrollment. Since the center was founded in 1998, we have awarded 105 doctoral degrees in information security. We're projecting it will be 150 by May 2010."

McAfee completed the survey in the fall, and Purdue's researchers spent December and early January analyzing the results.

"We are connected around the world in this global economy, but we don't have the rules, the same laws or the same attitudes about protecting information," Spafford said. "The theft of intellectual property is a real problem, and it's another layer affecting the economy. It's going to take cooperation among governments, private industry and the people who work in the areas of information security to bring cybercriminals to justice and lessen the problem." 

About the Center for Education and Research in Information Assurance Security

The Center for Education and Research in Information Assurance and Security (CERIAS) is a leading center for research and education in areas of information security to the protection of critical computing and communication infrastructure. CERIAS offers a multidisciplinary approach to the problems, ranging from purely technical issues (e.g., intrusion detection, network security, etc) to ethical, legal, educational, communication, linguistic, and economic issues, and the subtle interactions and dependencies among them. The research conducted through CERIAS involves faculty from six different colleges and more than 20+ departments across campus.

About McAfee, Inc.

McAfee, Inc., headquartered in Santa Clara, Calif., is the world's largest dedicated security technology company. The company delivers solutions and services that help secure systems and networks around the world, allowing users to connect to the Internet, browse and shop the Web more securely. McAfee creates products that empower home users, businesses, the public sector and service providers by enabling them to prove compliance with regulations, protect data, prevent disruptions, identify vulnerabilities, and continuously monitor and improve their security.

Writer: Jim Bush, (765) 494-2077, jsbush@purdue.edu

Sources: Karthik Kannan, (765) 494-3414, kkarthik@purdue.edu

Jackie Rees, (765) 494-0320, jrees@purdue.edu

Purdue News Service: (765) 494-2096; purduenews@purdue.edu

To the News Service home page