National Computer Security Survey SOURCE: U.S. DoJ (NCSS ESWG) (Submitted by TIA) TITLE: National Computer Security Survey AGENDA ITEM: 5.5-NGN - Cyber Security CONTACT: Ramona R. Rantala, Ramona.Rantala@usdoj.gov National Computer Security Survey Ramona R. Rantala U.S. Department of Justice Bureau of Justice Statistics May 2006 GSC-11 Chicago 2006

"Everyone knows that cybercrime and other computer incidents are a growing problem. But no one really knows how large, how fast it's growing, or where the problems are concentrated. And you can’t manage what you can't measure. The more we know about the extent of cybercrime, the better we'll all be able to combat it." Paul Kurtz Executive Director Computer Security Industry Alliance

Reliable Cybercrime Data Needed Nature of computer security incidents Prevalence by industry and type of incident Reporting to official organizations Types of offenders Monetary losses Downtime

Reliable Cybercrime Data Reveals vulnerabilities Identifies best security practices Technology Policy Other security measures Informs resource allocation Federal Economic sector Company

Current Cybercrime Data FTC identity theft data National Crime Victimization Survey National Prosecutors Survey Federal Justice Statistics Program National Incident-Based Reporting System CSI/FBI Computer Crime and Security Survey

Computer Security Survey Pilot Test Conducted as a feasibility test Are data reportable? Will companies participate? Employed extensive cognitive testing Analyzed non-response

CSS Pilot Test Non-Response Most common barriers Voluntary survey Don’t have time Less common barriers Legal/confidentiality concerns Data not available

CSS Pilot Test Results Of the 500 sampled companies, 42% responded 95% of respondents used computers Nearly 75% of companies with computers were victimized by cybercrime Reporting incidents to official organizations varied by type of incident Losses for 100 companies totaled $61 million and varied by type of incident

National Computer Security Survey Is being conducted in partnership between U.S. Department of Justice U.S. Department of Homeland Security Is being fielded on our behalf by the RAND Corporation, a private, non-profit research organization Collects comprehensive data on computer infrastructure, security, and incidents Is designed to be representative at national and industry levels

Maximizing NCSS Response Rates Endorsements Attorney General & Secretary of Homeland Security Computer security organizations Industry leaders Trade associations Project website General information Endorsers and quotes Frequently Asked Questions Contact information for DOJ, DHS, and RAND

Maximizing Response Rates (cont’d) Extensive follow-up All companies in sample receive, by regular post Initial packet Reminder letter Two additional packets Largest companies also receive Phone calls Fourth packet by FedEx Industry reports

Maximizing Response Rates (cont’d) Publicity Press releases Newspaper and journal articles Conference sessions Announcements Confidentiality P.L. 107-347, Title V [E-Government Act of 2002, CIPSEA (Confidential Information Protection)] 44 U.S.C. § 3501 note (codifies the E-Gov Act)

NCSS Survey Methodology Rigorous cognitive testing of questionnaire Scientific sample of 36,000 companies Stratified by industry and company size 5,000 certainty companies 50 largest companies in each industry All Fortune 1000 companies All companies employing more than 5,000 people 31,000 non-certainty companies Paper and Web-based survey instruments

Preliminary Results Roughly 3,500 mailed in February Remaining 32,500 mailed late April Response is steady and increasing Companies are reporting all types of incidents Results are not dissimilar to Pilot Test results, but not enough data has been collected to form even preliminary conclusions

E-Commerce E-commerce is defined as any transaction completed over a computer-mediated network that involves the transfer of ownership or rights to use goods or services. Examples: Taking orders for merchandise or services Transferring information or rights Paying accounts

E-Commerce Data Collected in NCSS Which of the following does this company have or use? Website with e-commerce Virtual Private Network Electronic Data Interchange Internet Intranet Extranet Which of the above were used, accessed, or affected in the incidents?

E-Commerce Data in NCSS (cont’d) Percentage of business transacted over Internet, Intranet, Extranet, Electronic Data Interchange, etc. Total operating revenue, sales, or receipts Percentage of this total derived from e-commerce

Contact Ramona Rantala Statistician DOJ/DHS NCSS Program Manager U.S. Department of Justice Bureau of Justice Statistics (202) 307-6170 Ramona.Rantala@usdoj.gov