Just more than half (54%) of the German and UK respondents in a recent Ovum/Vormetric survey believe that privileged users pose the biggest risk to their organization—a substantial step up from 38% in last year’s study.
According to the 2015 Vormetric Insider Threat Report—European Edition, only 13% said that their organizations were not at all vulnerable to insider threats—a slight improvement on the 9% that said they felt safe last year, but still leaving 87% feeling vulnerable.
The insider threat—posed by system administrators, database administrators, network administrators, etc., as well as contractors, service providers, and business partners—is a multi-faceted problem, and does not only relate to the deliberate theft of data. If systems are not appropriately secured, employees can also inadvertently put sensitive company information at risk.
In addition, modern cyber-attacks frequently rely on hijacking log-in credentials of unsuspecting users, often targeting ‘privileged users’ who have the greatest levels of network access. Cyber-criminals then use these credentials to log in and appear as legitimate users so that they can steal data undetected.
“With the research showing that more than half of European organisations now classify privileged users as posing the highest risk to their data, there is clearly a growing need to manage and secure what these users can do on the corporate network,” said Andrew Kellett, principal analyst for Infrastructure Solutions at Ovum. “Although most organizations will have already realized that this type of user account needs to be implemented and overseen with far greater care than they perhaps once were, there remains a variety of technical challenges to overcoming the risk they pose—not least because this type of user account is usually used to perform essential network maintenance and administration procedures that cannot be interfered with.”
Top European IT security spending priorities in thwarting insider threats identified by respondents were protection of intellectual property (52%) and preventing a data breach incident (48%). Forty percent of UK respondents reported that their organizations have encountered a data breach or failed a compliance audit in the last 12 months. Compliance was identified by respondents as still the top reason for securing sensitive data in Europe (56%), but reputation and brand protection are close behind (54%).
Although 51% of UK respondents and 44% of German respondents are increasing spending to offset threats to data, this lags behind 62% in the US.
“With 40% of UK firms either being breached or failing a compliance audit in the last year, we are clearly a long way from anything approaching adequate data security,” said Alan Kessler, CEO of Vormetric. “Part of the problem is an overemphasis on compliance. With insider related attacks changing by the hour, you can think of today’s compliance mandates as requiring organizations to use the weapons of yesterday to fight today’s battles. Given this reality, encryption and access controls are increasingly the weapons of choice today to protect organizations critical data.”