Are you ready for more security statistics? Newly published information indicates that Linux systems suffered an increasing number of attacks in the first half of 2002, compared with 2001. According to London company mi2g, Linux systems have suffered 7630 attacks so far in 2002, not including viruses and worms. During all of 2001, Linux systems suffered only 5736 attacks. The company said the attacks are largely because of third-party applications with vulnerabilities that administrators don't patch quickly enough.

On the other hand, attacks against Microsoft IIS systems have diminished. According to mi2g, attackers launched 9404 attacks against IIS systems in the first half of 2002, compared with 11,828 attacks in the first half of 2001.

Overall, however, the number of attacks against all systems rose 27 percent over last year. In the first half of 2001, organizations reported 16,007 attacks; so far this year, organizations have reported 20,371 attacks.

Government online systems are experiencing fewer attacks. Fifty-four US government systems reported attacks so far this year, compared with 204 such attacks in the first half of 2001. In the UK, only 12 government systems reported attacks this year, compared with 38 attacks in the first half of 2001. According to mi2g, the US Cyber Security Enhancement Act (CSEA) has probably helped reduce the number of attacks against government systems because the act permits much stiffer penalties for cybercrime.

The recently published Computer Emergency Response Team (CERT) statistics reflect an increase in the number of vulnerabilities reported this year. According to CERT, organizations have reported 2148 vulnerabilities so far this year, compared with 2437 reported vulnerabilities in 2001 and 1090 reported in 2000.

The Computer Security Institute (CSI) released statistics in April 2002 that CSI gathered in conjunction with the Federal Bureau of Investigation (FBI). CSI polled 503 security practitioners; 80 percent of those polled reported financial losses because of system breaches. Forty-four percent (223 entities) were willing to quantify their losses, which totaled about $455,848,000.

Riptech, a Virginia-based security services firm, recently released an interesting set of statistics. Riptech gathered log information from 400 companies in more than 30 countries and confirmed that more than 180,000 attacks took place in the first half of 2002. The report shows that 80 percent of all attacks originate from 10 countries, including the United States, Germany, South Korea, China, France, Canada, Italy, Taiwan, the UK, and Japan. You can read more about Riptech's report in the related news story.

With the exception of a few bright spots, the unsurprising news is that attacks are increasing. Some of the increase might be a function of a trend feeding on itself. For example, more organizations and individuals discover and report more vulnerabilities in some detail. Then, unscrupulous individuals use the details to perpetrate additional attacks. Also, each reported vulnerability—if left unpatched for too long—lets intruders attack an increasing number of systems. Because intruders use search-engine tactics to identify many vulnerable Web servers, the numbers can soar higher.

Given the current climate, patch your systems quickly. And take a moment to answer today's Instant Poll question about the security resources you need to keep your organization from becoming a negative security statistic.