Cyber security continues to be a huge concern for organizations, ahead of traditional crime, natural disasters and terrorism, according to the findings of Symantec’s 2011 State of Security Survey.

Respondents ranked cyber attacks as their top concern, followed by IT incidents caused by well-meaning insiders, and internally generated IT-related threats.

Forty-seven percent of respondents said mobile computing was affecting the difficulty of providing cyber security, followed by social media (46%), and the consumerization of IT (45%).

Seventy-one percent of organizations saw attacks in the past 12 months, compared to 75% in 2010. The percentage who reported an increasing frequency of attacks fell from 29% in 2010 to 21% in 2011.

Hackers are still their top concern, cited by 49%, followed by well-meaning insiders (46%).

The top attack vectors are malicious code, social engineering, and external malicious attacks. Interestingly, these are also the fastest growing attack vectors.

The top three reported losses were downtime, theft of employee’s identity information and theft of intellectual property.

The top costs were productivity; revenue; lost organization, customer, or employee data; and brand reputation.

In order to address these shortfalls, businesses are increasing staffing levels and budgets for the IT department.

According to the survey, by prioritizing risks and defining policies that span across all locations, businesses can enforce policies through built-in automation and workflow to protect information, identify threats, and remediate incidents as they occur or anticipate them before they happen.

Taking a content-aware approach to protecting information and proactively encrypting endpoints will also help organizations minimize the consequences associated with lost devices.

IT administrators need to validate and protect the identities of users, sites and devices throughout their organizations.

Furthermore, they need to provide trusted connections and authenticate transactions where appropriate.

Organizations need to manage systems by implementing secure operating environments, distributing and enforcing patch levels, automating processes to streamline efficiency, and monitoring and reporting on system status.

Defending critical internal servers and implementing the ability to back up and recover data should also be priorities. In addition, organizations need visibility, security intelligence and ongoing malware assessments of their environments to respond to threats rapidly.