Introduction

The 2000 CSI/FBI Computer Crime and Security Survey, conducted in early 2000 by the Computer Security Institute (CSI) with participation by the San Francisco office of the Federal Bureau of Investigation (FBI), showed that 90 percent of survey participants from large U.S. corporations, financial institutions, medical institutions, universities, and government agencies detected security breaches in 1999. About 70 percent of the participants experienced breaches more serious than viruses or employee Web abuse. Forty-two percent of survey participants (273 organizations) claimed financial losses totaling over 265 million dollars from cyber attacks. These security threats were composed of an assortment of attacks and abuses that originated both internally and externally to their network borders.

The CSI survey showed financial losses were larger than in any previous year in eight out of twelve categories. The largest loss was attributed to theft of proprietary information, followed by financial fraud, virus, insider net abuse, and unauthorized insider access.

Many organizations are increasing their use of electronic commerce for business-to-business and business-to-consumer transactions. New initiatives, such as Applications Service Providers (ASPs), expose vital corporate information and services to the Internet. People have altered the way that they work, now extending the workday or working full time from home. Telecommuters and mobile workers now require remote access to information resources normally protected within the organization s network.

Businesses and individuals now depend upon information systems and data communications to perform essential functions on a daily basis. In this environment of increasingly open and interconnected communication systems and...