Data Theft: How Well Are Swiss Companies Protecting Their Data?

KOF has researched the innovation activities and the degree of digitalisation of the Swiss economy in the period from 2014 to 2016 on behalf of the Swiss State Secretariat for Education, Research and Innovation (SERI). It was found that companies increasingly invest in the field of information and communication technology (ICT), specifically in security technology. The authors conclude that security technology plays the main role in the distribution of selected ICTs (see G 8). Over 60% of Swiss companies with more than five employees utilise external data carriers (offsite data backup) to back up their data, while over half of them utilise secure servers and as much as 40% regularly record network activities.

Data encryptions software (35%), authentication systems - for instance digital signatures - (30%), PIN codes, biometric methods or smart cards and intrusion detection systems (20%; IDS software) are further key security technologies. The latter are, however, less prevalent, in some cases significantly so. On the one hand, this is due to their limited application spectrum, especially in the case of smaller companies, and on the other due to higher one-off introduction costs which often make them affordable for bigger companies only.

In fact, having compared distribution patterns according to size categories, the authors conclude that, with the exception of external data backup, all of the security technologies are more prevalent among big companies than among small and medium-sized companies. Size differentials are particularly pronounced when it comes to IDS software and authentication systems and are particularly low in respect of external data backup. However, this does not mean that big companies are better at protecting their data. Big companies simply have automation advantages that justify higher investments on economic grounds.

Significant divergence between company sizes, small divergence between sectors

There is relatively little divergence in the distribution patterns of security technologies between different sectors (see G 9). The only exception is the construction industry, which shows a lower prevalence of all respective technologies. While external data backup technologies are widespread in both the industrial and the service sector, network activities are recorded more frequently among service providers. The latter also employ data encryption technologies more often than industrial enterprises. By contrast, secure servers are most prevalent in industry.

Despite all security strategies …

Aside from focussing on data security in technological terms, one in four respondents has also adopted an explicit security strategy for ICT use. However, this occurs much less frequently in the construction sector than in the industrial and service sectors. Over 70% of the big companies have adopted such a strategy. Among medium-sized companies, the figure is around 50%.

Not all of the companies with security strategies also have a cyber security officer. In total, this is the case for 20% of all respondents. Among big companies, the figure is almost one in two, among medium-sized companies around one-third.

In most cases, one person is responsible for this area, while around 15% of the companies have appointed two officers. However, the number is not just an expression of the role secure infrastructure plays at a given company, it also depends on the size of the business.

… security problems arise, especially in big companies

Despite the fact that many companies pursue explicit security strategies and increasingly use security technologies, a number of security problems arose in the period under review (2014 to 2016) and costs were incurred for remedial action. Around 40% of the respondents experienced security problems, such as viruses in their ICT infrastructure or Trojans. As regards the frequency of these incidents, there is only a minor difference between the industrial sector and the construction and service sectors. However, there are significant differences between the various company sizes: Around 70% of the big companies and around 50% of the medium-sized companies recorded security problems, while just under 40% of the small companies experienced such problems.

The incidents caused a variety of costs: Income was lost, for instance when orders could not be completed in due time, key data could not be recovered or companies lost customers. Just over 10% of all companies, and/or around one-quarter of the companies with incidents, suffered a medium or severe loss of income due to security problems. At close to 20%, the percentage in the construction sector was particularly high. The difference between industry and the service sector is negligible. Income was lost much more frequently by smaller companies than by medium-sized and big companies.

On top of this, companies were forced to invest in remedial action. Around 17% of the companies reported medium to very high expenditure in this context (see G 10). Among bigger companies, remedial action expenditure was often higher than among small and medium-sized companies.