Analytics
4/9/2009
05:59 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Many Enterprises Still Don't Recognize Insider Threat, Studies Say

Small businesses are chief laggards in deploying data leakage protection technology, researchers say

Despite recent headlines and instances of insider attacks, many companies still are not acting to protect themselves from insider threats, according to two new analyst reports.

Forrester Research earlier this week published a study called "Data Security Challenges and Technology Adoption in 2008," which offers a detailed look at enterprises' attitudes about security and the deployment of next-generation security technologies.

Although 88 percent of the respondents said they consider data security a "challenging issue," some 40 percent of respondents said they had no interest in, no plans for, or no knowledge of emerging tools for information leak protection.

While the Forrester study included enterprises of all sizes, a separate study published last week by Redshift Research suggests that small businesses may be the chief laggards in recognizing the insider threat.

The Redshift study, which was conducted on behalf of security software vendor GFI, found that approximately half of small and midsize enterprises are "not that concerned" about the possibility of departing employees taking data with them. Only 22 percent believe that internal security threats are greater than external threats.

"This indifference toward the danger of deliberate data leakage is reflected by only 45 percent having security applications in place to automatically screen or prevent network access via portable USB drives," the Redshift study says. "Even fewer (35 percent) screen network access via PDAs -- making it far too easy for employees to edit, copy, delete, or distribute sensitive data."

Sixty percent of small organizations have no formal policy for regulating access to the network by portable devices, Redshift says. Twenty-one percent of respondents have no ability to track where business-critical data is stored at any point in time, 33 percent cannot track what portable devices have been connected to the network, and 41 percent have no ability to tell what data has been downloaded to these devices, the study says.

"Too much emphasis has historically been placed upon the need for antivirus and antispam applications -- external threats," says Walter Scott, CEO of GFI Software. "This has led to the common belief that with these, your network is secure enough. A secure network depends on many other factors and, unfortunately, the internal threat is far too often being ignored. There is a pervasive indifference toward monitoring the whereabouts of data and its ability to accessed or copied."

The Forrester study takes the opposite view, noting that the majority of companies are deploying data leakage protection (DLP) technology, and that heavily regulated industries -- such as finance, insurance, utilities, and telecommunications -- are taking interest in DLP at an even higher rate. In the Forrester study, the retail/wholesale and manufacturing industries showed the least interest in DLP, but even in those industries, the majority of companies showed some interest.

"The current economic environment means data protection will be the CISO's top priority," Forrester says. "Protecting insider threats will continue to increase in a downturn." Forrester suggests that those companies still ignoring the insider threat will change their attitudes over time.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web