When talking about statistics, definitions of what is to be measured and how to do that is crucial. Ralf Bendrath at RISKS mentions an interesting case where pears and apples were being compared. This only demonstrates how slippery current use of statistics in security is.

"When asked by the Department of Justice about the number of computer security cases in 2000, the Air Force Office of Special Investigations (AFOSI) staff counted 14 for the whole Air Force. The Department of Defense overall count for all services, to the surprise of the AFOSI staff, later summed up to some 30 000. The explanation: The other services had counted non-dangerous events like unidentified pings as hacker attacks, while the AFOSI only had considered serious cases."

10:31:22 PM