"If anything, the more you take care of the little stuff, the less likely someone will be able to pull off a big attack," says Schmidt. "I see it all the time. Companies are always pushing, ’Let’s just open this one little port.’ Then next thing you know, they want another port and another. And that leads to all these vulnerabilities that turn into little brushfires. No one draws the line and says no. Instead of creating a culture of security, we’re often creating a culture of getting around security."

The encouraging message buried in Schmidt’s commentary is that in order to mitigate the problem, little if any additional technology, spending or other resources are really required. All that’s required is some discipline—someone to draw the line and say no.

The other matter to deal with here is the high percentage of respondents (40 percent) who indicated that they were unsure of their losses. This probably can be attributed to the fact that security is still a young discipline. If it wasn’t money that was lost, respondents simply don’t know how to calculate the cost of losing intellectual property, or some part of a company’s reputation, or even downtime.

So they don’t try. This is a function of information security’s immaturity, a trait that will reappear in the next cut of data. If companies can’t calculate the cost of a breach, it’s highly unlikely that they’re even trying to create a formula for figuring security ROI.

To Do:

1. Refocus a security program so that it takes into account the smaller, more frequent threats as well as "the sky is falling" threats.

2. Assign a disciplinarian, and vigilantly enforce security rules.

Still Reactive After All These Fears

Despite experts preaching about risk management and treating security proactively, security is still largely justified by fear and government regulation.

What the Numbers Mean

No matter how much evangelizing experts do about making security a contributor to the bottom line and measuring its ROI, it’s still easier to rely on scare tactics to justify security investments.

The numbers indicate how counterproductive that is. For example, the low percentage of respondents who take into consideration the security requirements of their partners and vendors means that they aren’t thinking about security as an external networking problem. Their thinking still focuses on "How will a hacker attack me?" and not "How will any given hack attack reach me?" Also, companies aren’t demanding that their partners and vendors meet given security levels, which would make interaction safer.