8 June 2007

Three-quarters of organisations believe they are exposed to cybercrime

Eleanor Dallaway

Only one quarter of IT security professionals have full confidence in their network security, according to a 1200-strong survey.

US encryption company SafeNet surveyed 1200 UK senior IT and security professionals, and found that 67% were not fully confident about protecting their networks from security breaches, while 7% felt not at all secure. “In one year, the number of organisations that feel very vulnerable to cybercrime has almost quadrupled,” said Gary Clark, the firm's European vice-president.

If IT experts within their own organisations have such low confidence in their own security measures, “it does not bode well for the board, shareholders or customers,” he added.

Employee misuse and theft of information was raised as the biggest fear in compromising security, with 32% of those questioned saying this was the biggest threat. This was ahead of unauthorised access by outsiders, cited by 27%.

Tony Neate, managing director of industry and government-funded organisation Getsafeonline.org, said that training is the key to reducing such risks. “The correct training not only reduces the risk of problems at work, but it can also improve IT skills, increase confidence online and encourage employees to apply better security practices at home too,” he said.

“Effective online security is not just about installing the right software – staff also have to be trained in how to spot the danger signs. The better trained an employee is, the more confidence a business can have in their network security,” Neate added.

The survey confirms that despite enabling workers, remote working continues to cause concern. Loss of mobile devices containing confidential information was the biggest fear for 20% of respondents.

Andy Kellett, senior researcher for analyst Butler Group, said infosecurity staff have only recently become aware of such risks. “A lot of IT security people focused on the key protection areas of the business, and not a lot of work had been done on information loss and protecting endpoint devices,” such as mobile devices and laptops.

“I don’t know if they saw it as outside their remit, but it fell into the category of, ‘if we pretend it’s not a problem, it will go away’.” This is no longer good enough, he added.

“Not enough is being done to protect organisations’ critical information,” said SafeNet’s Clark. “Only enforced security standards that focus on staff education and the smart use of technology, with the full support of senior executives, will successfully tackle this fear factor.”