CXOs Need to Think Differently About Insider Risk, Says New Report
Accidental security incidents by company insiders happen more frequently and have the potential for greater negative impact than malicious insider attacks, according to a new IDC report commissioned by RSA, the security division of EMC. The IDC white paper also shows a misalignment of security concerns by a majority of CXOs who give higher priority to protecting against malicious insider attacks over investing to prevent more frequent and potentially more damaging accidental insider security incidents.
The white paper, ‘Insider Risk Management: A Framework Approach to Internal Security’, addresses insider risk, which is the potential threat that an organisation is exposed to by internal users who have access to critical systems and confidential information. While aware that users create information security risks within their organisations, external threats often overshadow the importance of protecting against internal risks. The new research uncovers a misalignment of CXO security concerns with the greater number of internal breaches and the threat posed to a business’ bottom line by accidental security breaches, inappropriate access and misuse of information by its employee base.
Among the global IT decision makers that responded to the survey, the majority indicated they were unclear on the sources and intentions of internal risk and struggled to quantify the potential financial consequences and workflow impact. Of the organisations surveyed, 52% characterised their insider threat incidents as predominately accidental, only 19% believed the threats were deliberate, while the remaining 26% believed they were an equal combination and 3% were unsure. However, when asked to rank their top threats, almost 82% of CXOs were unsure if incidents from contractors and temporary staff were accidental or deliberate.
“Employers view their relationship with employees as one of trust and recognise their people are their biggest asset,” said Chris Christiansen, programme vice president, security products of IDC. “But, the vast nature of an organisation’s infrastructure, coupled with a dispersed, often global employee base, and complex internal user mix of employees, consultants, partners and outsourcers make addressing the risks posed by its internal users the biggest security challenge that CXO’s currently face: whether the risk is intentional or not, it’s there. It’s real.”
Other results from the white paper highlight the number of insider security incidents from within an organisation. In the previous 12 months, 400 respondents admitted to 6,244 incidents of unintentional data loss, 5,830 malware/spyware attacks from within the enterprise, and 5,794 incidents of risks created by excessive privilege and access control rights. In total, the number of internal security incidents from the respondents came out at 57,485 in the previous 12 months. The survey results show that almost 40% of organisations plan to increase spending on initiatives to reduce internal security risks over the next 12 months and as few as 6% will decrease spending. These results indicate there is not a single solution to best address internal security risks but rather a need to take a comprehensive risk management approach to better understand the organisations’ risk profile and where to best put controls in place, concludes the report.