Need a statistic....?

Question

I need a genuine link to a statistic to the percentile of Information Security breaches. I need to know what percent of the attacks come from the "inside", pertaining to "Personnel Security" I have seen a statistic stating 70%, supposedly by the FBI. This source did not cite their source. Any help would be much appreciated. My brain is drawing a blank, and I have not been able to come up with a good reference,

Answer 1

It depends on the type of inside attack. See the following:

More than 50% of identity theft cases are caused by insiders with legitimate access to sensitive customer information.
Source: Michigan State University Identity Theft Lab, 2004

83% of companies surveyed experienced security breaches of some kind in 2004. 62% report attacks from an internal source.
Source: 2004 Deloitte Global Security Survey

How big is the problem? The “2003 Computer Crime and Security Survey,” compiled by the Computer Security Institute and the FBI, found that 62 percent of respondents reported a security incident involving an insider, up from 57 percent in 2002. IT executives attending this summer’s Gartner IT Security Summit, meanwhile, cited insider threats from employees and trading partners as their top worries.

The last link is interesting. It's from 2006 and lists various statistics and how the users attacked. They said that "The 2005 E-Crime Watch SurveyTM conducted by the United States Secret Service, CERT® Coordination Center (CERT/CC), and CSO Magazine,1 found that in cases where respondents could identify the perpetrator of an electronic crime, 20% were committed by insiders." 20% is really low compared to what I've always heard with about 75%-80%, but they also said that when they do attack, they have higher privileges and can therefore make much more substantial impact and cause more monetary damage.

Unfortunately, I can't give you a definite percentage, but that's probably because it's a statistic and you can sway that any way you decide to add up the numbers.

WG