Analytics
4/9/2009
05:59 PM
50%
50%

Many Enterprises Still Don't Recognize Insider Threat, Studies Say

Small businesses are chief laggards in deploying data leakage protection technology, researchers say

Despite recent headlines and instances of insider attacks, many companies still are not acting to protect themselves from insider threats, according to two new analyst reports.

Forrester Research earlier this week published a study called "Data Security Challenges and Technology Adoption in 2008," which offers a detailed look at enterprises' attitudes about security and the deployment of next-generation security technologies.

Although 88 percent of the respondents said they consider data security a "challenging issue," some 40 percent of respondents said they had no interest in, no plans for, or no knowledge of emerging tools for information leak protection.

While the Forrester study included enterprises of all sizes, a separate study published last week by Redshift Research suggests that small businesses may be the chief laggards in recognizing the insider threat.

The Redshift study, which was conducted on behalf of security software vendor GFI, found that approximately half of small and midsize enterprises are "not that concerned" about the possibility of departing employees taking data with them. Only 22 percent believe that internal security threats are greater than external threats.

"This indifference toward the danger of deliberate data leakage is reflected by only 45 percent having security applications in place to automatically screen or prevent network access via portable USB drives," the Redshift study says. "Even fewer (35 percent) screen network access via PDAs -- making it far too easy for employees to edit, copy, delete, or distribute sensitive data."

Sixty percent of small organizations have no formal policy for regulating access to the network by portable devices, Redshift says. Twenty-one percent of respondents have no ability to track where business-critical data is stored at any point in time, 33 percent cannot track what portable devices have been connected to the network, and 41 percent have no ability to tell what data has been downloaded to these devices, the study says.

"Too much emphasis has historically been placed upon the need for antivirus and antispam applications -- external threats," says Walter Scott, CEO of GFI Software. "This has led to the common belief that with these, your network is secure enough. A secure network depends on many other factors and, unfortunately, the internal threat is far too often being ignored. There is a pervasive indifference toward monitoring the whereabouts of data and its ability to accessed or copied."

The Forrester study takes the opposite view, noting that the majority of companies are deploying data leakage protection (DLP) technology, and that heavily regulated industries -- such as finance, insurance, utilities, and telecommunications -- are taking interest in DLP at an even higher rate. In the Forrester study, the retail/wholesale and manufacturing industries showed the least interest in DLP, but even in those industries, the majority of companies showed some interest.

"The current economic environment means data protection will be the CISO's top priority," Forrester says. "Protecting insider threats will continue to increase in a downturn." Forrester suggests that those companies still ignoring the insider threat will change their attitudes over time.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0543
Published: 2015-07-05
EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2015-0544
Published: 2015-07-05
EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value.

CVE-2015-4129
Published: 2015-07-05
SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie.

CVE-2015-0547
Published: 2015-07-04
The D2CenterstageService.getComments service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors.

CVE-2015-0548
Published: 2015-07-04
The D2DownloadService.getDownloadUrls service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report