WASHINGTON, June 10: The recent epidemic of cyber attacks has led to greater investment and spending on security, but fears are rising that hackers are gaining the upper hand, a study showed today.
A Rand Corporation study based on a survey of company chief information officers (CIOs) said rising concerns from high- profile incidents have made cyber security a priority for many organisations.
The authors cited prior research showing worldwide spending on cyber security is approaching $70 billion per year and growing at 10 to 15 percent annually but said that "it would be an understatement to say organisations are dissatisfied with their security."
"Companies know what they spend on cyber security, but quantifying what they save by preventing malicious attacks is much harder to tally," said Lillian Ablon, a Rand researcher and co-author of the report.
"Cyber security is a continual cycle of trying to eliminate weaknesses and out-think an attacker. Currently, the best that defenders can do is to make it expensive for the attackers in terms of money, time, resources and research."
The researchers found that the effect of a cyber attack on reputation - rather than direct costs - caused the most concern for chief information security officers (CISOs).
The report in coordination with Juniper Networks said the cost of managing cyber security is set to increase 38 percent over the next ten years across all businesses - largely from investment in tools and training, and dealing handling the use of personal devices such as smartphones which connect to corporate networks.
"One of the most challenging issues facing companies is the countermeasures attackers use to evade defenses," the report said.
"Attackers are constantly developing countermeasures to new security technologies, which limits the relative effectiveness of those tools over time and requires companies to invest in new technologies to take their place."
The researchers said evaluating cyber security is difficult because so much is shrouded in secrecy. Despite the wave of attacks that have become public in recent months, the methods used by hackers to infiltrate systems and countermeasures are often kept private.
The report noted that "cyber security is a hard sell, especially to chief executives" but that there is now greater focus on security measures.
