The survey of 400 chief experience officers (CXOs) in the UK, France, Germany and the USA found that the insider security threats that caused the largest number of instances, such as unintentional data loss through employee negligence, and the greatest financial impact of for example out-of-date or excessive privileges and access control rights for users, were accidental.
The white paper, Insider Risk Management: A Framework Approach to Internal Security, shows that the majority of CXOs give higher priority to protection against malicious insider attacks over investing to prevent more the more frequent, and potentially more harmful, accidental insider security incidents.
Christopher Young, senior vice president of RSA Products, said: “Internal risks are growing and to remain competitive, CXOs must change the way they defend their business and expand security priorities to address the heightened need for protection from risk both intentional and accidental from an insider.
“CXOs must adopt a holistic strategy to mitigate insider threat that focuses on protecting critical information from misuse, leakage and loss by internal users, whether accidental or deliberate”, he added.
The survey also found that the greatest source of insider threat came from contractors and temporary employees. The average annual financial loss from insider risk was nearly US$800 000 in the IT outsourcing industry.
The research into insider security risks found that while 93% of respondents were responsible for security decisions within their organisations, almost 82% were not clear on the source of their company’s insider risk and could not precisely pinpoint or quantify the nature of the financial impact.
This was despite the fact that 52% of the surveyed companies characterising their insider threat incidents as predominantly accidental. Only 19% believed insider security threats were deliberate, whereas 26% believed it was an equal combination. Three percent were unsure.
Over the last year, the 400 respondents have seen 6244 incidents of unintentional data loss, 5830 malware and/or spyware attacks from within the organisation, and 5794 incidents of risks created by excessive privilege and access control rights.
Almost 40% of the respondents said they plan to increase spending on initiatives to reduce internal security risks over the next year – only six percent will decrease spending.