Virus Related Statistics:

From Message Labs, 17 Jan, 2004, http://www.messagelabs.com

• Processing between 50,000 and 60,000 new copies per hour, "W32/Mydoom.A has exceeded the infamous SoBig.F virus in terms of copies intercepted, and the number continues to rise."
• Message Labs collected over 1.2 Million copies of W32/Mydoom.A-mm
• At its peak infection rate, about 1 in 12 emails on the Internet were MyDoom Viruses 

From Trend Micro, 16 Jan, 2004, Computer World Article

• It is estimated that PC Viruses cost businesses approximately $55 Billion in damages in 2003.
• The same calculations in were done in 2002 and 2001, at $20-30 Billion and $13 Billion, respectively.

From Joint CAIDA, ICSI, Silicon Defense, UC Berkeley, and UC San Diego, 01 February 2003, http://www.caida.org/analysis/security/sapphire/

An analysis of the Sapphire/Slammer SQL worm shows:

• "This worm required roughly 10 minutes to spread worldwide making it by far the fastest worm to date."
• "In the early stages [the number of compromised hosts] was doubling in size every 8.5 seconds."
• "At its peak, achieved approximately 3 minutes after it was released, Sapphire scanned the net at over 55 million IP addresses per second."
• "It infected at least 75,000 victims and probably considerably more."
  

From Sophos, 28 February 2002, http://www.sophos.com/virusinfo/whitepapers/prevention.html

• "The number of known viruses surpassed 70,000 in January 2002"
• Of the 70,000, "26.1% are macro viruses, 26.1% are Trojan horses, 19.2% are executable and 6.8% are script viruses"
• "Unix, boot sector, internet worms, file, Macintosh and multipartite [viruses] account for the remaining 21.8%"
• "The number of new viruses discovered every month continues to increase. In the last quarter of 2001, the Sophos virus lab was processing around 1200 new viruses each month."
  

From SANS, 3 October 2001, http://www.incidents.org/react/nimda.pdf

86,000+ Internet hosts are thought to have been compromised and used to propagate the NIMDA worm, on September 18th.  37,318 (42.97%) of those hosts resided in the US.

From CAIDA, 25 July 2001, see our Web Defacement section http://www.caida.org/analysis/security/code-red/

After significant analysis, the Cooperative Association for Internet Data Analysis (CAIDA) found that the "Code Red" worm affected more than 359,000 servers in less than 14 hours.  They also determined:

• "At the peak of the infection frenzy, more than 2,000 new hosts were infected each minute."
• "43% of all infected hosts were in the United States"
• "11% originated in Korea"
• "5% of [the infected hosts] were in China, and 4% in Taiwan"
• A QuickTime animation of the geographic expansion of the worm was also made available.

From Information Security Magazine, May 2001, http://www.infosecuritymag.com/articles/may01/...

• According to Internet Security Systems , there were 71,402 virus attacks reported in the fourth quarter of 2000 alone.
• According to IDC Asia/Pacific , an estimated 25% of major companies in the Pacific Rim do not employ the use of virus protection on their systems.  

From SecurityPortal.Com, 25 October 2000, http://securityportal.com/research/virus/virustop20.html

"The VBS.Loveletter virus now has over 40 variants, with more making their appearance every week."

From ICSA.Net, 23 October 2000, http://www.securitystats.com/reports.asp , "2000 Computer Virus Prevalence Survey":

• The number of corporations infected by viruses has risen by 20% this year alone
• 99.67% of companies surveyed experienced at least one virus encounter during the survey period
• 51% claimed they had at least one "virus disaster" during the 12-month period before they were surveyed
• 80% said the "LoveLetter" virus was their most recent virus disaster
• The monthly rate of infection per 1000 PCs has been nearly doubling every year since 1996
• The reported damage estimate from the "LoveLetter" virus is as much as $10 Billion.
• The reported damage estimate from the "Melissa" virus was $385 Million
• Including hard and soft dollar figures, the true cost of virus disasters is between $100,000 and $1 Million per company

From Network Associates, 2 September 2000, http://vil.nai.com/villib/alpha.asp

To date, there are an estimated 53,000 computer viruses in existance.

From BBC World News, 8 June 2000, http://news.bbc.co.uk/hi/english/sci/tech/newsid_782000/782099.stm

The ILOVEYOU virus "is believed to have affected at least 45 million computer users."

From The Computer Security Institute with the participation of the San Francisco Federal Bureau of Investigation's (FBI) Computer Intrusion Squad, 22 March 2000, http://www.gocsi.com/prelea_000321.htm , out of 643 respondents:

• 85% detected computer viruses
• 273 organizations that were able to quantify their losses reported a total of $265,589,940

From Information Security Magazine, December 1999, 1999 Infosecurity Year-in-Review

• In September 1999, two new Y2K-related virus/worms were discovered, which sent user’s IDs and passwords out over the Internet via e-mail. Microsoft reported finding eight different versions of the e-mail in circulation.
• On April 22nd, 1999, according to newswire reports, the Chernobyl computer virus struck hundreds of thousands of computers in Asia and the Middle East, with Turkey and South Korea each reporting 300,000 damaged computers.

From Information Week, 12 July 1999, Global Security Survey: Virus Attack

Based on responses from 2,700 executives, security professionals, and technology managers from 49 countries:

• "Globally, about 64% of companies were hit by at least one virus in the past 12 months, up from 53% the year before. In the United States, viruses stung 69% of companies. Those figures are about four times as high as the next highest category of security breaches: unauthorized network entry."
• Viruses and computer hacking will cost U.S. businesses an estimated $266 billion this year--more than 2.5 percent of America's Gross Domestic Product (GDP)
• "The percentage of companies suffering security breaches increased slightly. Last year, 27% of companies responding said they had not suffered a security breach. This year, only 24% could make that claim. In the United States, just 22% reported no security breaches."

Trends:

"CERT/CC Overview Incident and Vulnerability Trends" , 8/17/2002

"Virus Trends" , InfoSecMag.Com, May 2002

More...

Security Spending:

"Security breaches cause $15 billion in damages" , Datamonitor, Nov. 2000

More...

Defacements:

"8071 Web Sites Hacked - 56.67% ran Windows NT, 8.25% ran Solaris" , Attrition , Jan 2001

More...

Dont's:

" The Seven Worst Security Mistakes Senior Executives Make" , SANS, May 1999

Monthly Numbers:

From Information Security Magazine ,
- January 2001
- Feb 2001
- March 2001
- A pril 2001