Police: Pen tests could thwart 90 percent of breaches

Some 90 percent of data breaches investigated by the NSW Police's fraud squad could have been avoided if organisations conducted penetration tests, according to a senior official at the cybercrime fighting unit.

Detective superintendent Bruce van der Graaf said the tests would detect holes in IT systems that were responsible for almost all theft of corporate databases.

"I don't know why more people don't do it," he said. "It could be too expensive, but consider the the pain of recovery after your business is breached."

Penetration tests help organisations identify holes in information security systems that could allow data to be stolen and then sold on web forums.

Bruce van der Graff will give a detailed account on efforts to curb online fraud at SC Magazine's 'Security on the Move' conference in Sydney next month. Click here to register.

Van der Graaf said penetration testing was just one of many areas in IT security that needed some attention to drive down the frequency of online fraud.

More police and resources were also needed, he said.

Database theft is on the increase, van der Graaf noted. He said he has seen a big shift in electronic crime who since joining the fraud unit in 1988.

"This year has been a challenge, a big learning curve," van der Graaf said. "We are [starting to] appreciate the scale and sophistication of the crimes."

He said fraud was more public back in the '80s and early '90s, and has since become more hidden and dangerous.