CERT statistics point to increasing security woes

From...

By Sam Costello

(IDG) -- A new set of security statistics released Friday by the Computer Emergency Response Team Coordination Center (CERT/CC) finds that in the first quarter of 2001 a number of security issues, including incident and vulnerability reports, are on track to top 2000 figures.

CERT/CC is a government-funded computer security research and development center based at Pittsburgh's Carnegie Mellon University. CERT/CC, and other similar organizations that work with it, study and track Internet security risks such as viruses, security holes, and intrusions.

MESSAGE BOARD Security on the Net   IDG.net INFOCENTER InfoWorld Main Page InfoWorld Test Center Subscribe to InfoWorld Newsletters Infoworld Opinions and Spotlights Related IDG.net Stories CERT to sell security threat information Tech consortium unveils security spec Microsoft launches first security product Features Top 10 rules for e-business success Bluetooth wireless connectivity set to take off DSL in distress Visit an IDG site Choose a site: IDG.net CIO Computerworld Darwin Dummies.com GamePro.com The Industry Standard ITWorld.com InfoWorld.com JavaWorld LinuxWorld Macworld Online Network World Fusion PC World Publish.com UnixInsider IDG.net search

For the first quarter of 2001, CERT/CC received 7,047 incident reports, putting 2001 on pace to eclipse 2000's total of 21,756. Incident reports have increased annually over the last several years. Before 2000, the year with the most reports was 1999, which tallied 9,859 reports.

Vulnerability reports tipped the scales at 633 for the most recent quarter, close to last year's total of 1,090 and surpassing the next-closest year, again 1999, which had 417. Security notes were up, with three so far in 2001, compared to only 10 in all of last year. CERT/CC sends such notices to its e-mail subscribers when incidents have occurred and also posts them on its Web site.

An incident is defined by CERT/CC as "any related set of activities," according to Bill Pollack, CERT/CC spokesman. Under this definition, a large-scale virus outbreak such as the Melissa virus counts as one incident, just as a smaller event also counts as one, he said.

CERT/CC also handled more than 18,000 incoming e-mail messages in the first three months of 2001, compared to just over 56,000 for all of last year. Calls to CERT/CC's hotline have edged just above 400 so far this year, whereas there were nearly 1,300 in 2000.

Based on the first quarter, not all categories are on track to top last year's figures. The organization published five security alerts, a slower pace than the one that led to 22 alerts in 2000.

Security notes and alerts are distinguished by levels of seriousness, Pollack said. A security alert is the "most serious alert we send out to the community," he said.

All numbers reported in CERT/CC's statistics are gathered directly by the organization through e-mail, phone, and other means, he said. The numbers show a steady upward trend across the board. With data listed as far back as 1998, CERT/CC's first year of operation, the figures show a constant and steady rise in the number of security issues that CERT/CC has dealt with.

Though this rise is "commensurate with the growth of the use of the Internet," it also underscores the point that "intruder activity is a serious problem and continuing to grow," Pollack said.

Pollack declined to speculate as to whether incidents will continue on their current pace for the rest of 2001 or into 2002, but he did allow that the figures are trending upward.

To keep them from growing any more, Pollack said that users and companies need to take precautions, such as checking CERT/CC's Web site for the latest vulnerabilities and incidents, as well as paying attention to and applying bug fixes and patches as vendors make those available.

CERT to sell security threat information
April 20, 2001
Guninski finds another hole in MS Exchange security
March 29, 2001
Symantec launches new version of security suite
March 21, 2001
Hacker steals huge credit card database
December 13, 2000
CERT steps up disclosure of security holes
October 12, 2000

CERT to sell security threat information
(IDG.net)
Tech consortium unveils security spec
(IDG.net)
Microsoft launches first security product
(IDG.net)
'Anti-security' technologies of 2000
(InfoWorld.com)
Security at your fingertips
(PCWorld.com)
Security: An uneasy alliance
(InfoWorld.com)
CERT stepping up disclosures of security holes
(Computerworld)
Another flaw exposed in TCP
(InfoWorld.com)

CERT

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.