Any one responsible for the security of a trusted network will be concerned when connecting
it to a distrusted network. In the case of connections to the Internet this concern may be based
largely on anecdotal evidence gleaned from widespread media coverage of security breaches. A
closer inspection of the facts and statistics behind some of the media coverage will, however, only
serve to deepen that concern. For example, the US National Computer Security Agency (NCSA)
asserts that most attacks to computer systems go undetected and unreported, citing attacks made
against 9,000 Department of Defence computers by the US Defence Information Systems Agency

(DISA). These attacks had an 88 percent success rate and went undetected by more than 95 percent
of the target organizations. Only 5 percent of the 5 percent that detected an attack, a mere 22 sites,
reacted to it.
It is noteworthy that these sites belong to the US Department of Defence (DoD) and were
not commercial sites, which may give security less priority than the DoD.
NCSA also quote the FBI as reporting that in more than 80 percent of FBI investigated
computer crimes, unauthorized access was gained through the Internet.
Putting a value on the damage done by such attacks is difficult but a 1995 survey conducted
by Ernst & Young, a New York based accounting firm, reported that one third of businesses
connected to the Internet reported up to 100 000 USD in financial loss over a two year period due
to malicious acts by computer users outside the firm. A little more than two percent of connected
companies reported losses of more than 1M USD.
There is amazement in the computer security industry at the level of ignorance to the
problem. To understand the risks often involves a steep learning curve and they have few real
parallels in everyday life, for example nobody worries that a burglar will be able to trick their
front door into opening by posting cryptic messages through the letterbox. When there is a good
"hacker" story to report the press goes into frenzy, but the general level of awareness is still
surprisingly low. For example, the Sunday Times which prides itself on providing accurate
coverage of IT issues published an article recently that claimed that most businesses worry too
much about Internet security. The article goes on to explain that encryption is all that is needed to
be completely secure. The article focuses purely on privacy of communication and completely
misses the possibility of an attack originating from the Internet.

1, anecdotal  [,ænik'dəutəl]
adj. 轶事的；轶事一样的；多轶事的

2, glean  [ɡli:n]
vt. 收集（资料）；拾（落穗）
vi. 收集；拾落穗
3, breach  [bri:tʃ]
n. 违背，违反；缺口
vt. 违反，破坏；打破
4, citing 
vbl. 引用,引证,举例
5, burglar  ['bə:ɡlə]
n. 夜贼，窃贼
6, cryptic  ['kriptik]
a. 秘密的(使用密码的,意义深远的)