Have we reached the cyber crime saturation point?

gallery

ANALYSIS: A rather interesting blog post came out of Symantec this week.

It made a statement that simultaneously appeared to go against the run of play in the security sphere, and yet made perfect sense.

In the post, Symantec researcher Kevin Haley claimed we have reached a “saturation point” with security incidents.

“The bad guys just can’t pump out new malware any faster. Check out the Norton Cybercrime Index. The trends for 2011 are pretty much flat,” he said.

“The explosive growth in malware we’ve seen in the previous 10 years is just not sustainable. Maybe new hacker tools will come along, new propagation methods, or more platforms, or more people to infect. But for now, things are beginning to stagnate.”

So have we really hit saturation point?

Dreaming of a data breach deluge?

Given the slew of security breaches which have seen in 2011 already, these sentiments might seem a little odd.

There’s been Sony, RSA and Citigroup, alongside the numerous hits made by LulzSec and Anonymous on both Government bodies and private organisations. Games companies have taken an absolute pounding, in particular.

Security professionals seem to think more attacks are coming their way too. During a briefing with HP this week, the tech giant revealed survey results from InfoSecurity 2011 showing an overwhelming 81 per cent expecting attack frequency to rise.

But the signs indicate those security professionals are a tad misguided. As Haley said, just look at the Norton Cyber Crime Index:

That bright yellow line tells you all you need to know - levels are pretty flat. The index takes into account all kinds of different attacks, including fraud, identity theft, malware and spam. You can check out the index for yourself here.

There is a simple explanation for the dichotomy of the increasing prominence of breaches in the media and the stabilisation in growth of incidents: attacks are becoming more noticeable, whilst not growing in frequency.

“How to explain the nearly endless parade of security incidents we've seen in the last few weeks? Well, in some ways, these are the puddles forming on the ground. It’s not that rain has gotten harder,” Haley explained.

“It’s just that the ground has stopped absorbing them all. Some of what we are seeing does reflect the bad guys attacking new platforms and finding new people to infect. But it’s mainly puddles.”

Slower growth rates for threats started emerging last year. A Panda Security report from November showed the growth rate of new threats was in decline, finding from 2003 new threats had increased at a rate of 100 per cent or more. But by that point in 2010, the rate of growth was around 50 per cent.

Now in mid-2011, growth has declined even further. We are indeed at saturation point.

Houston, we have still got a problem…

So if security incident levels are stagnating, we can start relaxing a little, right? Obviously not. In fact, companies should be more afraid than they have ever been.

The reason why we have hit saturation point is we are now at a peak for malware growth and incident occurrence. That means things are bad. It would be more appropriate to call it a nadir than a zenith.

Email to a friend

Print this page