Many Enterprises Still Don't Recognize Insider Threat, Studies Say

Despite recent headlines and instances of insider attacks, many companies still are not acting to protect themselves from insider threats, according to two new analyst reports.

Forrester Research earlier this week published a study called "Data Security Challenges and Technology Adoption in 2008," which offers a detailed look at enterprises' attitudes about security and the deployment of next-generation security technologies.

Although 88 percent of the respondents said they consider data security a "challenging issue," some 40 percent of respondents said they had no interest in, no plans for, or no knowledge of emerging tools for information leak protection.

While the Forrester study included enterprises of all sizes, a separate study published last week by Redshift Research suggests that small businesses may be the chief laggards in recognizing the insider threat.

The Redshift study, which was conducted on behalf of security software vendor GFI, found that approximately half of small and midsize enterprises are "not that concerned" about the possibility of departing employees taking data with them. Only 22 percent believe that internal security threats are greater than external threats.

"This indifference toward the danger of deliberate data leakage is reflected by only 45 percent having security applications in place to automatically screen or prevent network access via portable USB drives," the Redshift study says. "Even fewer (35 percent) screen network access via PDAs -- making it far too easy for employees to edit, copy, delete, or distribute sensitive data."

Sixty percent of small organizations have no formal policy for regulating access to the network by portable devices, Redshift says. Twenty-one percent of respondents have no ability to track where business-critical data is stored at any point in time, 33 percent cannot track what portable devices have been connected to the network, and 41 percent have no ability to tell what data has been downloaded to these devices, the study says.

"Too much emphasis has historically been placed upon the need for antivirus and antispam applications -- external threats," says Walter Scott, CEO of GFI Software. "This has led to the common belief that with these, your network is secure enough. A secure network depends on many other factors and, unfortunately, the internal threat is far too often being ignored. There is a pervasive indifference toward monitoring the whereabouts of data and its ability to accessed or copied."

The Forrester study takes the opposite view, noting that the majority of companies are deploying data leakage protection (DLP) technology, and that heavily regulated industries -- such as finance, insurance, utilities, and telecommunications -- are taking interest in DLP at an even higher rate. In the Forrester study, the retail/wholesale and manufacturing industries showed the least interest in DLP, but even in those industries, the majority of companies showed some interest.

"The current economic environment means data protection will be the CISO's top priority," Forrester says. "Protecting insider threats will continue to increase in a downturn." Forrester suggests that those companies still ignoring the insider threat will change their attitudes over time.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message