• PC World
• »Security

The Internet is an increasingly dangerous place to be--at least for your PC. Despite growing public awareness of security threats, computers are still too vulnerable, according to new security statistics released Friday by the Computer Emergency Response Team Coordination Center.

The report shows that in first quarter of 2001 a number of security issues, including incident and vulnerability reports, are on track to top 2000 totals.

CERT/CC is a government-funded computer-security research and development center based at Pittsburgh's Carnegie Mellon University. CERT/CC and similar organizations that work with it study and track Internet security risks. Those risks include viruses, security holes, and intrusions.

More Incidents and Notes, but Fewer Alerts

For the first quarter of 2001, CERT/CC received 7047 incident reports, putting 2001 on pace to eclipse 2000's total of 21,756. Incident reports have increased annually over the last several years. Before 2000, the year with the most reports was 1999, which tallied 9859 reports.

Vulnerability reports tipped the scales at 633 for the most recent quarter, close to last year's total of 1090 and surpassing the next-closest year, again 1999, which had 417. Security notes were up, with three so far in 2001, compared with only 10 in all of last year. CERT/CC sends such notices to its e-mail subscribers when incidents have occurred and also posts them on its Web site.

An incident is defined by CERT/CC as "any related set of activities," says Bill Pollack, CERT/CC spokesperson. Under this definition, a large-scale virus outbreak like the Melissa virus counts as one incident, just as a smaller event also counts as one, he says.

E-Mail Deluge

CERT/CC also handled more than 18,000 incoming e-mail messages in the first three months of 2001, compared to just over 56,000 for all of last year. Calls to CERT/CC's hotline have edged just above 400 so far this year, whereas there were nearly 1300 in 2000.

However, based on the first quarter, not all categories are on track to top last year's figures. The organization has published five security alerts so far--a slower pace than the one that led to 22 alerts in 2000.

Security notes and alerts are distinguished by levels of seriousness, Pollack says. A security alert is the "most serious alert we send out to the community," he says.

All numbers reported in CERT/CC's statistics are gathered directly by the organization, through e-mail, phone, and other means, he says. The numbers show a steady upward trend across the board. With data listed as far back as 1998, CERT/CC's first year, the figures show a constant and steady rise in the number of security issues that CERT/CC has dealt with.

Though this rise is "commensurate with the growth of the use of the Internet," it also underscores the point that "intruder activity is a serious problem and continuing to grow," Pollack says.

Pollack declined to speculate as to whether incidents will continue on their current pace for the rest of 2001 or into 2002, but he did allow that the figures are trending upward.

To keep them from growing any more, Pollack says that users and companies need to take precautions, such as checking CERT/CC's Web site for the latest vulnerabilities and incidents, as well as paying attention to and applying bug fixes and patches as vendors make those available.

• See more like this:
• CERT,
• internet security,
• vulnerability,
• security,
• securtity alert,
• security threat,
• Computer Emergency Response Team Coordination Center