A panel of security experts at the RSA Conference last week said businesses still overlook fundamental security questions when buying or building software.
That's critical because Gartner estimates that 70 percent of security vulnerabilities are at the application layer (see our coverage of the panel at www.nww.com, DocFinder: 2243).
A survey by the Secure Software Forum, which pulled together the panel for the conference, shows that although companies are beginning to develop secure coding programs, only 27 percent have integrated security into their development processes.
Because perimeter security can only do so much, this software vulnerability may be responsible for the recent uptick in unauthorized use of computer systems, as shown by the newly released 10th annual "Computer Crime and Security Survey." The study, conducted by the Computer Security Institute (CSI) and the FBI, reports that after declining for four years, the unauthorized use of computers increased in 2005: Of the companies surveyed, 56 percent reported unauthorized use, up from 53 percent in 2004. As for the rest, 31 percent reported no unauthorized use, and 13 percent were unsure.
That survey also showed that - contrary to the popular notion that insiders are the graver threat - just about as many unauthorized incidents were perpetrated by outsiders as by insiders. Perhaps even more important, a large percentage of respondents simply don't know where the misuse came from. When asked how many incidents came from outside, 35 percent said they didn't know. Asked the same about misuse from inside, 44 percent said they were unsure.
The lesson, the CSI/FBI survey concludes, is that "organizations have to anticipate attacks from all quarters."
Despite the increase in computer misuse and companies' uncertainty about what they are battling, the CSI/FBI survey suggests that, based on spending trends, companies seem to think they are doing enough to fight back. Security spending as a percentage of IT budgets remained essentially flat in 2005 compared with 2004.
Forty-eight percent of the respondents spend 1 percent to 5 percent of their IT budget on security, 19 percent spend 6 percent to 10 percent, and 8 percent said they spend more than 10 percent. Remarkably, 25 percent said they still spend less than 1 percent of their IT budget on security.
The take-away is that there is a lot of work left to do.