Businesses in Australia and the Asia-Pacific region are among the biggest targets for hackers and security attacks, but they also have the slackest security measures, according to a global Deloitte IT security survey.

And they are struggling to deal with it because of poor planning and a lack of skills.

The top-three breaches around the world are email attacks through, for example, spam, viruses and worms, and phishing (where frauds obtain information such as credit card details and passwords by posing as legitimate entities) and pharming (where website traffic is redirected to a bogus website).

The survey of 169 global financial services industry organisations in 32 countries, including seven from Australia, found that 79 per cent of businesses in the Asia-Pacific region - excluding Japan - had experienced repeated external security breaches in the past year.

This was the second highest after Canada.

Despite this, the study also revealed that none of the Asia-Pacific region businesses had managers in charge of security strategies, in contrast to the other regions in the study - the US, Japan, the former Soviet republics, Europe, the Middle East and Africa, Canada, and Latin America and the Caribbean.

But 78 per cent of respondents in the region said security was now a priority for top management and boards, and 62 per cent confirmed they had a security strategy in place.

Deloitte security and risk partner Julie Priest said the findings went to the heart of a "security paradox": the chasm between awareness of the problem and support for the solution.

"While information-security incidents continue to grab the attention of business executives, ownership of the underlying problems is still perceived to rest with IT," Ms Priest said.

The study also revealed that a skills shortage in the region might be hampering efforts to combat attacks. Significantly, the skills shortage was more acute in the Asia-Pacific region than in other parts of the world.

Only 7 per cent of participants felt they had the skills to handle existing and future security requirements, well below the global average of 30 per cent.