Analytics
4/9/2009
05:59 PM
Connect Directly
RSS
E-Mail
50%
50%

Many Enterprises Still Don't Recognize Insider Threat, Studies Say

Small businesses are chief laggards in deploying data leakage protection technology, researchers say

Despite recent headlines and instances of insider attacks, many companies still are not acting to protect themselves from insider threats, according to two new analyst reports.

Forrester Research earlier this week published a study called "Data Security Challenges and Technology Adoption in 2008," which offers a detailed look at enterprises' attitudes about security and the deployment of next-generation security technologies.

Although 88 percent of the respondents said they consider data security a "challenging issue," some 40 percent of respondents said they had no interest in, no plans for, or no knowledge of emerging tools for information leak protection.

While the Forrester study included enterprises of all sizes, a separate study published last week by Redshift Research suggests that small businesses may be the chief laggards in recognizing the insider threat.

The Redshift study, which was conducted on behalf of security software vendor GFI, found that approximately half of small and midsize enterprises are "not that concerned" about the possibility of departing employees taking data with them. Only 22 percent believe that internal security threats are greater than external threats.

"This indifference toward the danger of deliberate data leakage is reflected by only 45 percent having security applications in place to automatically screen or prevent network access via portable USB drives," the Redshift study says. "Even fewer (35 percent) screen network access via PDAs -- making it far too easy for employees to edit, copy, delete, or distribute sensitive data."

Sixty percent of small organizations have no formal policy for regulating access to the network by portable devices, Redshift says. Twenty-one percent of respondents have no ability to track where business-critical data is stored at any point in time, 33 percent cannot track what portable devices have been connected to the network, and 41 percent have no ability to tell what data has been downloaded to these devices, the study says.

"Too much emphasis has historically been placed upon the need for antivirus and antispam applications -- external threats," says Walter Scott, CEO of GFI Software. "This has led to the common belief that with these, your network is secure enough. A secure network depends on many other factors and, unfortunately, the internal threat is far too often being ignored. There is a pervasive indifference toward monitoring the whereabouts of data and its ability to accessed or copied."

The Forrester study takes the opposite view, noting that the majority of companies are deploying data leakage protection (DLP) technology, and that heavily regulated industries -- such as finance, insurance, utilities, and telecommunications -- are taking interest in DLP at an even higher rate. In the Forrester study, the retail/wholesale and manufacturing industries showed the least interest in DLP, but even in those industries, the majority of companies showed some interest.

"The current economic environment means data protection will be the CISO's top priority," Forrester says. "Protecting insider threats will continue to increase in a downturn." Forrester suggests that those companies still ignoring the insider threat will change their attitudes over time.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Threat Intel Today
Threat Intel Today
The 397 respondents to our new survey buy into using intel to stay ahead of attackers: 85% say threat intelligence plays some role in their IT security strategies, and many of them subscribe to two or more third-party feeds; 10% leverage five or more.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2595
Published: 2014-08-31
The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which all...

CVE-2013-2597
Published: 2014-08-31
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that lever...

CVE-2013-2598
Published: 2014-08-31
app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to overwrite signature-verification code via crafted boot-image load-destination header values that specify memory ...

CVE-2013-2599
Published: 2014-08-31
A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption pas...

CVE-2013-6124
Published: 2014-08-31
The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command, as demonstrated by changing the permissions of an arbitrary fil...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.