End Users Causing Bulk Of Infosec Headaches

Misconfigured systems and software vulnerabilities may cause their share of woes in the information security world, but the actions of end users perennially serve up the worst nightmares for infosec professionals. That fact was confirmed again today with a new survey conducted by Bromium that shows nearly 80 percent of security professionals name end users as their biggest security headache.

The survey showed that among the most dangerous activities end users participate in, clicking on suspicious or malicious links, opening suspicious or malicious attachments, and bypassing security controls are the ones that introduce the most risk to the business.

This is further exacerbated by the ever-increasing targeting of these weak links by cybercriminals; according to a separate report out today by Agari, approximately three-fourths of all companies are at high risk of malicious email attacks.

In many cases, employees engage in risky behavior due to a lack of awareness of what risky links or emails look like, or why security controls are in place. According to a study conducted by Aberdeen Group, user awareness and training can reduce risk by about 60 percent.

"Actions that are taken by individual end-users – the networks and devices we use, the files we send and receive, the apps we install and run, the links we click on, the emails we open –are behaviors that result in a high percentage of security infections," says Derek Brink, analyst for Aberdeen Group.

However, that is only one part of the puzzle.

"In addition to struggling to maintain control over their users, many information security professionals are struggling to maintain control over their current security systems," the Bromium report stated.

The survey by Bromium showed that security professionals are also overwhelmed by the volume of attacks and the management of duplicative solutions meant to protect users' machines. Almost half of security pros noted that multiple, redundant point solutions introduce the most cost and complexity into their security. And the majority—over 60 percent—report that they investigate or respond to 50 percent or less of their security alerts.

"This represents a huge security gap," the Bromium report states. "It is a challenging time for information security professionals, because the traditional security model has been unable to scale with the volume of transactions generated by the modern enterprise."