From the CSO Security and Risk Blogs:

Forrester Research surveyed over 2,300 IT execs in Canada, France, Germany, the UK, and the US. Twenty-five percent admitted they suffered a security breach in the past year.

First, some methodology: LinkedIn Research conducted the survey on Forrester’s behalf in June and those polled were from small and medium-sized businesses (SMB) and enterprises. The survey was part of
Forrester’s Forrsights for Business Technology.

The report also notes that 21 percent of respondents didn’t feel comfortable answering that question even though their responses were anonymous. This, Forrester’s Phil LeClare told me in an email, goes to show just how sensitive enterprises have become to the potential economic impact and damage to corporate reputation of a publicized security breach. Even more interesting, je said, is that 7 percent reported “Don’t know.”

Here are some more nuggets of the report, written by John Kindervag and Rick Holland (with help from Stephanie Balaouras and Kelley Mak):

Breaches are expensive. Sony announced that it will cost the company more than $170 million to clean up the PlayStation Network breach alone.1 One financial analyst estimates that the breach will
ultimately cost the company $1.25 billion in lost business, compensation, and new investments.

During the past 12 months, 25 percent of IT security decision-makers and influencers reported at least one breach of their sensitive information. It’s interesting to note that 21 percent of respondents didn’t feel comfortable answering that question — although their responses were anonymous — a testament to just how sensitive enterprises have become to the potential economic impact and damage to corporate reputation of a publicized security breach.

Even more interesting is that 7% reported “Don’t know.” Forrester believes that even among those respondents that reported “no breaches in the past 12 months,” many of them have suffered a breach — they just don’t know it.

In today’s changed threat landscape, cybercriminals are skilled,
well-funded, and patient. They target their attacks and do everything in their power to conceal their activity so that they can accomplish their goal, whether it’s to steal intellectual property or conduct
man-in-the-middle attacks.

In Forrester’s experience, incident response is one of the most overlooked areas of information security. Surprisingly, even among those enterprises that have already suffered a breach during the
past 12 months, only 18% increased spending on their incidence response program as a result. Sadly, and perhaps even more surprisingly, many enterprises did nothing at all as the result of their breach. Others increased spending on breach prevention technologies.

I don’t find the responses and conclusions particularly surprising. It is consistent with other survey results I’ve seen in recent months.

But any snapshot of what we’re all up against is worth repeating, since so many companies continue to struggle.

–Bill Brenner