2016 - Cybercrime Surveys Report: Acknowledgements

Cyber ROAD
Development of the Cybercrime and

Cyber-Terrorism Research Roadmap European Commission
Seventh Framework Programme
www.cyberroad-project.eu
2016 - Cybercrime Surveys Report

Authors – Jart Armin & Bryn Thompson (CyberDefcon) & Piotr Kijewski (NASK)
Table of Contents
1 Overview of the Cybercrime Surveys ...................................................................................................... 2
1.1 Introduction .................................................................................................................................... 2
1.2 Methodology .................................................................................................................................. 2
2 Results and Findings ................................................................................................................................ 4
2.1 Definitions of cybercrime ............................................................................................................... 4
2.2 What activities are considered to be cybercrimes? ....................................................................... 4
2.3 Best practices and workplace policies ............................................................................................ 5
2.4 Cyber security responsibility .......................................................................................................... 8
2.5 Security solutions ........................................................................................................................... 9
2.6 Sources of data and information on cybercrime .......................................................................... 10
2.7 Personal experiences of cybercrime............................................................................................. 10
2.8 Consumer rights ........................................................................................................................... 12
2.9 Cybercrime research – Return on Investment (ROI) .................................................................... 12
2.10 Information sharing ...................................................................................................................... 14
2.11 Cyber Threats................................................................................................................................ 15
3 Analysis from the stakeholder surveys – What are the research gaps? ............................................... 16
3.1 Gap Analysis.................................................................................................................................. 16
4 Conclusions............................................................................................................................................ 18
Acknowledgements
The authors would like to provide grateful thanks to all the many survey participants & respondents who
gave up valuable time to complete the surveys, this report is primarily for you. To the European Commission
Seventh Framework Programme, that made this possible. APWG, MAAWG, ENISA, and the wider cyber
security community. LinkedIn, Survey Monkey, Google, & the CyberROAD team;
UNIVERSITÀ DEGLI STUDI DI CAGLIARI, TECHNISCHE UNIVERSITAET DARMSTADT, INDRA, POSTE ITALIANE,
SECURITY MATTERS, VITROCISET, FOUNDATION FOR RESEARCH AND TECHNOLOGY HELLAS, INOV,
DEMOKRITOS, SBA, PROPRS, MINISTÉRIO DA JUSTIÇA (PORTUGAL), CEFRIEL, SUPSI, ROYAL HOLLOWAY,
MINISTRY OF NATIONAL DEFENCE, GREECE, MELANI
Cybercrime Surveys Report © CyberROAD 2016 Page 1 of 20 May 2016

Cyber ROAD
1 Overview of the Cybercrime Surveys

1.1 Introduction
Partners from academia, industry, computer security, and legal enforcement agencies came together for
the CyberROAD project (June 2014 – May 2016) with the aim of developing a cybercrime and cyber
terrorism roadmap of the research areas vital to facing forthcoming threats in the lead up to 2020.
This report summarizes the findings from the CyberROAD cybercrime surveys circulated to interested
stakeholders across target groups ranging from subject specialists in industry and academia, policy makers,
law enforcement, hosting providers and knowledgeable IT users.
In total 2,200 English or Polish speaking stakeholders, in the EU and 20 other countries, responded to the
wide-ranging, Delphi-based, survey questions.
The findings provide a snapshot of cybercrime-related, real-life experiences across a diverse landscape of
technology-enabled scenarios. Areas of research, that are sometimes overlooked, are explored in this series
of surveys through the actual experiences of the participants. These contributing evidences help to form
the basis of academic papers and publications presented at the ARES Conference in 2015 ‘2020 Cybercrime
Economic Costs: No Measure No Solution’1 and a forthcoming Springer publication2.
The surveys provide an insight into the impact of cybercrime on stakeholders, achieving a major goal of the
project, and serve as a primary contributor to the concluding CyberROAD roadmap, i.e. what areas of
technological and social research should the EU invest in.
1.2 Methodology
The surveys were designed using specialist online software based on the Delphi method where a series of
surveys drawdown to explore previously answered questions at a deeper level. The initial survey was of a
generic nature followed by two further surveys divided by the subject matter; Survey 2 – Technical and
Organizational; Survey 3 – Social, Economic and Political.
In order to capitalize upon the intended European standpoint of the surveys they were designed to allow
for a comparative study between different regions from world to EU and to country specific (macro to
micro). Two versions of the surveys were made available: one for English speakers worldwide and the other
translated into Polish and aimed at Polish users. Poland was primarily selected as a statistical control group,
as the Polish language is primarily spoken only within one country and therefore the results provide a
crossmatch of one EU country versus multiple countries to establish any cultural bias or imbalance of survey
questions from the results. As the results shown, all Polish results were within 5% of the English language
survey results.
The surveys were distributed in a variety of formats: project website, a dedicated website, announcements
via social media, and prompting by email to interested parties.
The breakdown of respondents can be shown as:
1
http://ieeexplore.ieee.org/xpl/articleDetails.jsp?reload=true&arnumber=7299982
2
http://www.springer.com/gb/

Cyber ROAD

Cyber ROAD
2 Results and Findings

2.1 Definitions of cybercrime
The definition of cybercrime was explored in the surveys. Six choices of definition were provided in Survey
1 asking “For me cybercrime is…?” In Survey 2 participants were asked to select a definition from the three
top choices from Survey 1.
2.2 What activities are considered to be cybercrimes?

More than 62% of Survey 1 participants said they were either “Extremely Concerned” or “Very Concerned”
about cybercrime. Participants expressed what they considered to be a cybercriminal act and what was
considered by respondents as ‘not’ an act of cybercrime in Surveys 2 and 3.

Cyber ROAD
2.3 Best practices and workplace policies

Survey 1 indicated that BYOD rates are high with more than 70% of participants using their own devices
within the work-place. Rates for BYOD best practices are not following pace with only 26% these
organizations having a BYOD best practices policy in place. Survey 2 participants were asked how highly this
discrepancy rated as a potential security risk.

Cyber ROAD
Survey 1 respondents indicated a lack of formal cybersecurity management policies in their place of work.
In Survey 2 explored this theme further asking why they thought this was the case.
Participants were asked if there was a clear policy within their work place on how to escalate anything
suspicious.

Cyber ROAD

Cyber ROAD
2.4 Cyber security responsibility

Respondents were asked how much responsibility they felt for cyber security in their work place. Nearly
69% said they felt a shared responsibility while 31% felt their responsibility was only small.
Survey 1 indicated low levels of training on cybersecurity within their workplace. Survey 3 respondents were
asked who should be responsible for the cost of training.

Cyber ROAD
2.5 Security solutions

Survey 1 indicated a reliance on firewalls and antivirus as cyber security solutions while proactive tools such
as EWS, VoIP encryption, DLP, have low rates of adoption. Survey 2 respondents were asked why that is the
case. The results were:
Over 90% of respondents of the more advanced Survey 2 – Technical and Organizational thought there was
too much pressure to prematurely roll out IW/web applications and projects.

Cyber ROAD
2.6 Sources of data and information on cybercrime

Participants were asked which sources of cybercrime data or information did they trust the most?
2.7 Personal experiences of cybercrime

Participants were asked about their own personal experience of cybercriminal activity.
As previous respondents had indicated the two greatest effects of cybercrime had been “down time” and
“inconvenience” respondents were asked how much time was lost as a victim to cybercrime.

Cyber ROAD

Cyber ROAD
2.8 Consumer rights

Over 92 % of respondents believe that consumer rights should be strengthened with more sanctions and
heavier penalties available to appropriate organizations. Should consumer rights organizations in any
country or region (e.g., the European BEUC, Bureau Européen des Unions de Consommateurs, or National
Data Protection Authorities DPA's, similar to the Federal Trade Commission, FTC in the USA), be given
enhanced powers to sanction heavier legal & financial penalties, when poor security measures result in
data breaches or cybercriminal events?
2.9 Cybercrime research – Return on Investment (ROI)

To improve cyber security, Return on Investment. Participants were asked where money should be spent
in the future? Results in order of preference:
1. Education in cybercrime prevention
2. Cyber security management
3. Laws and policies on cybercrime
4. Risks & effects of cybercrime
5. Economic impact of cybercrime
6. Cybercrime definitions and classifications

Cyber ROAD

Cyber ROAD
2.10 Information sharing

Results from Survey 1 indicated that sharing of information on cyber incidents is not common practice.
Participants were asked why they thought this was the case.

Cyber ROAD
2.11 Cyber Threats

Cyber ROAD
3 Analysis from the stakeholder surveys – What are the

research gaps?
3.1 Gap Analysis
Consequences Defense
Theme Scenario Research GAP
(actual view) (future view)
No standard
definitions;
Lack of international Clear-cut definitions
Perceptions How to achieve cross-
agreements; legal of cybercrime and
differ on what border agreement and
Definitions sanctions take place cross-border co-
is an act of internationally agreed
within national operation to improve
cybercrime sanctions
borders where legal sanctions
perceptions may
differ
High BYOD
Best Practices
usage with low Compliance within the Policies and best
and Workplace High risk workplace
rates of best workplace. Effective practices for the
Cyber Security environments
practice measures in place. workplace
Policies
policies
Responsibility
boundaries are clear Cyber security as a
Divided views cut between shared responsibility.
Ineffective cyber
on where governments, ISPs, Where/what are the
Cybersecurity security measures due
responsibility service providers, law overlaps? Who should
Responsibility to inappropriate
for cyber enforcement, end pay for cyber security
responsibilities
security lays. users and training?
international
organisations.
Inappropriate Proactive security

Proactive and
Cybersecurity solutions to Breaches are not adoption from
appropriate solutions
Solutions known cyber prevented development to the
in place
security issues workplace
What sources
Lack of trust in data
of data can be Industry standards Industry standards and
and security
Trusted Sources trusted in the and benchmarking benchmarking. What
information.
of Data absence of with data provided by determines a trusted
Inaccurate forecasting
industry trusted sources. source for data?
for budgets
benchmarking?

Cyber ROAD
Real-life vs Fit-for-purpose
Inappropriate
Stakeholder assumed Proactive security, fit- solutions. Actual
solutions providing
Experiences scenarios and for-purpose measures consequences of
ineffective measures
consequences cybercriminal activity.
Entities are not

There are few encouraged to raise Consumer rights have
Consumer consumer standards to prevent a high profile with Industry standards and
Rights rights in the incidents as the stiff penalties for consumer rights issues
industry penalties, where they breaches
exist, are set too low
Research and
Inappropriate
development
solutions and
Return on projects are not R&D will provide Where should research
ineffective measures
Investment & required to appropriate return on money be spent in the
as a result of
Economics prove their investments future?
inadequate research
cost-
and development
effectiveness.
Stakeholders
do not know
Incident and event
who to share What makes a trusted
Inaccurate collation of information will be
information entity? How can
Information data and a barrier to shared with trusted
with although information sharing be
Sharing legal action against entities followed by
they encouraged in a safe
perpetrators of crime appropriate legal
understand the environment.
action
value of doing
so

Cyber ROAD
4 Conclusions
Stakeholder responses to the CyberROAD surveys provide a snapshot of personal experiences of
cybercriminal activities and cyber security policies within the home and at work. The surveys illustrate the
need for changes in perceptions and practices before cyber security solutions can be fully effective.
Practices within the workplace fall short of what is desired leaving staff without proper guidance and at
high risk to threats. Proper guidelines and processes within a comprehensive cyber security plan improves
defenses against attack. More research on how these can be enacted is necessary.
Other problems areas highlighted are a lack of information sharing which limits the ability to collect and
collate accurate cyber security data. Stakeholders often do not know where to report incidents or lack trust
in the appointed entity. This limits the capacity to take appropriate action which is further hindered by the
lack of cross-border cooperation between legal entities.
Industry standards are yet to fully evolve meaning that benchmarking is not commonplace. Consumer rights
can be enhanced with appropriate best practices in place.
Reactive security is extensive with inappropriate measures in place that are not fit-for-purpose. Stakeholder
experiences indicate that proactive security is not usual with attitudes to newer ideas slow to change.
The surveys highlight that research gaps are widespread and improved ROI could be achieved through
funding being targeted in these areas.
The electronic version of this document is available on the official CyberROAD project’s website
www.cyberroad.eu

Cyber ROAD
Why Cyber Security Research Matters
Cyber criminal activities are reported to be continuously growing and are negatively impacting the development
of the European society and economy, and are pervasively affecting all the aspects of our daily lifes. Even though
the level of awareness of cyber threats has increased, and Law Enforcement acts globally to fight against them,
illegal profits have reached unsustainable figures. In addition to the economic reasons, however, cyber crime
often hides other political and social motivations.
What is CyberROAD?
CyberROAD is a 24-month research project funded by the European Commission under the Seventh Framework
Programme (with a total budget of 1.300.000 €).
In order to help coordinate the European efforts in the fight against cyber crime and cyber terrorism, the
CyberROAD project has identified 19 research topics on which Europe should concentrate resources to increase
its security and resilience, organizing them in strategic roadmap for Cyber Security Research.
The roadmap encompasses all the aspects which may contribute to reach this goal, from the development of
better and more robust technologies for prevention, detection and mitigation of the attacks, to the legal and
forensics aspects concerning the fight against cyber crime and cyber terrorism, up to the need of developing
better methods to measure and to analyse the phenomenon and make the citizens more aware of it.
The roadmap is the final outcome of a process of information collection and analysis, during which the existing
literature has been deeply analysed, public events and interviews with the relevant stakeholders have been
organized in order to grasp the future challenges which our society will be called to face in the forthcoming years.
A ranking methodology has been also applied to the devised research topics which allows to obtain different
views of the research roadmap tailored on the needs of the different stakeholders which may be interested in
the project outcomes.
Who Participates in CyberROAD?
The CyberROAD project has been implemented by a consortium of 20 international partners, involved in the fight
against Cyber Crime and Cyber Terrorism. Members include representatives from Academia and Research,
Industry, Government and NGOs across Europe:
 PRA Lab, University of Cagliari, Italy (Project coordinator).
 CEFRIEL - Forcing Innovation, Italy.
 CyberDefcon, UK.
 National Centre for Scientific Research “Demokritos”, Greece.
 FORTH - Institute of Computer Science, Greece.
 Governo de Portugal - Ministério da Justiça, Portugal.
 Hellenic Republic - Ministry of National Defence, Greece.
 Indra, Spain.
 INOV - Inesc Inovação, Portugal.
 McAfee, UK.
 MELANI - Reporting and Analysis Centre for Information Assurance, Switzerland.
 NASK, Poland.
 Poste Italiane, Italy.
 PROPRS - Professional Probabilistic Risk Solutions, UK.
 Royal Holloway - University of London, UK.
 SBA Research, Austria.
 Security Matters, Netherlands.
 SUPSI - Scuola Universitaria Professionale della Svizzera Italiana, Switzerland.
 Technische Universitaet Darmstadt, Germany.
 Vitrociset, Italy

Cyber ROAD
The CyberROAD Consortium
Visit our Website
http://www.cyberroad-project.eu/en/
Join us in Social Media
https://twitter.com/cyberroad_eu
https://www.facebook.com/cyberroadproject
https://www.linkedin.com/groups/CyberROAD-8184478
Contact the Coordinator
Prof. Fabio Roli

Department of Electrical and Electronic Engineering
University of Cagliari - Piazza d'Armi 09123, Cagliari, Italia.
E-mail: [email protected], Phone: +39 070 675 5779, Fax: +39 070 675 5782

2016 - Cybercrime Surveys Report: Acknowledgements

Uploaded by

Copyright:

Available Formats

2016 - Cybercrime Surveys Report: Acknowledgements

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

2016 - Cybercrime Surveys Report: Acknowledgements

Uploaded by

Copyright:

Available Formats

Cyber ROAD

Development of the Cybercrime and

2016 - Cybercrime Surveys Report

Cybercrime Surveys Report © CyberROAD 2016 Page 1 of 20 May 2016

1 Overview of the Cybercrime Surveys

Cybercrime Surveys Report © CyberROAD 2016 Page 2 of 20 May 2016

Cybercrime Surveys Report © CyberROAD 2016 Page 3 of 20 May 2016

2 Results and Findings

2.2 What activities are considered to be cybercrimes?

Cybercrime Surveys Report © CyberROAD 2016 Page 4 of 20 May 2016

2.3 Best practices and workplace policies

Cybercrime Surveys Report © CyberROAD 2016 Page 5 of 20 May 2016

Cybercrime Surveys Report © CyberROAD 2016 Page 6 of 20 May 2016

Cybercrime Surveys Report © CyberROAD 2016 Page 7 of 20 May 2016

2.4 Cyber security responsibility

Cybercrime Surveys Report © CyberROAD 2016 Page 8 of 20 May 2016

2.5 Security solutions

Cybercrime Surveys Report © CyberROAD 2016 Page 9 of 20 May 2016

2.6 Sources of data and information on cybercrime

2.7 Personal experiences of cybercrime

Cybercrime Surveys Report © CyberROAD 2016 Page 10 of 20 May 2016

Cybercrime Surveys Report © CyberROAD 2016 Page 11 of 20 May 2016

2.8 Consumer rights

2.9 Cybercrime research – Return on Investment (ROI)

Cybercrime Surveys Report © CyberROAD 2016 Page 12 of 20 May 2016

Cybercrime Surveys Report © CyberROAD 2016 Page 13 of 20 May 2016

2.10 Information sharing

Cybercrime Surveys Report © CyberROAD 2016 Page 14 of 20 May 2016

2.11 Cyber Threats

Cybercrime Surveys Report © CyberROAD 2016 Page 15 of 20 May 2016

3 Analysis from the stakeholder surveys – What are the

Inappropriate Proactive security

Cybercrime Surveys Report © CyberROAD 2016 Page 16 of 20 May 2016

Entities are not

Cybercrime Surveys Report © CyberROAD 2016 Page 17 of 20 May 2016

Cybercrime Surveys Report © CyberROAD 2016 Page 18 of 20 May 2016

Why Cyber Security Research Matters

Who Participates in CyberROAD?

Cybercrime Surveys Report © CyberROAD 2016 Page 19 of 20 May 2016

The CyberROAD Consortium

Visit our Website

Join us in Social Media

Contact the Coordinator

Prof. Fabio Roli

Cybercrime Surveys Report © CyberROAD 2016 Page 20 of 20 May 2016

You might also like