There was a story published in The Register (a really great source of news, btw) earlier this week that I am just now getting around to reading, "UK PLC security prognosis mixed."  They gave a synopsis of some of the findings in the DTI Information Security Breaches Survey 2006; there is an Executive Summary and the full report.

Well...it is Friday...and I still have over half of my week's to-do list to get done...but I'm always curious about these types of surveys...so here are just a few excerpts and thoughts about the findings from the full DTI report:

"Overall, the cost of security breaches to UK plc is up by roughly 50% since two years ago, and is of the order of ten billion pounds per annum."

This is around $18billion U.S. dollars and around 14,380,043,082 Euro.  (Here's a nice little currency conversion calculator.)

" The average cost of a UK company’s worst security incident of the year was roughly £12,000 (up from £10,000 two years ago)."

This is US $21,613.20...seems low to me.  But then again, averages can be misleading.

"Roughly two-fifths of businesses spend less than 1% of their IT budget on information security."

Well...kinda, but then again not really, too surprising...seems excessively low.  Definitely disappointing to see information security is still so low on the budget totem pole.

"There is still a shortage of security qualified staff; only one in eight companies has any."

Wow!  This low number does surprise me.

"Three-fifths of UK businesses are still without an overall security policy, though a third of these have defined an acceptable usage policy for the Internet."

This is surprising also.  I wonder, with this lack of staff and lack of policies, how accurate the cost of security breaches truly is?  There is likely a lot of security problems going on...including fraud and insider abuse...that is not known or being discovered.  There's no one on staff, and no technology being used, to discover them!

Well...there is so much more to the report...I only got to page 5 of the full report.  Check it out; I'll look through it more closely this weekend.

Technorati Tags
information security
UK
DTI Information Security Breaches Survey
IT budget
security breaches
security study