As enterprises become larger, managing employee behaviour becomes harder and the risk of a breach occurring within an organisation intensifies. Companies are aware the threat looms large, with 40% of firms expecting a data breach in the next 12 months, as a result of employee behaviour and employees indicating widespread lack of awareness of good cyber security practice.
This raises an important question, why have firms been so slow to address the insider threat and how can they do so?
The 2015 Clearswift Insider Threat Index, released today, aims to answer this question. It includes data from extensive research into the security priorities and awareness of over 500 IT decision makers and 4,000 employees across the UK, US, Germany and Australia. It aims to provide comprehensive ‘insider threat intelligence’ on the risks insiders pose to their organisations, to inform decision making on security policy, technology and process.
The report shows employee awareness is a major part of the problem. 75% of employees believe their company provides inadequate levels of information about data policies and what is expected of them. And 58% lack understanding of what might actually constitute a security threat from within their organisation.
With such a lack of clarity, it may not come as a surprise that 50% admit that they disregard data protection policies at work in order to get their job done. These attitudes highlight an imperative for organisations to make training employees in security protocols and policies a priority area for the safety and security of the business.
Such attitudes are not surprising considering 72% of security professionals believe internal security threats are still not treated with the same level of importance as external threats by the Board.
Heath Davies, Chief Executive at Clearswift said: “The detachment between the front line security professionals and Board members within an organisation is particularly worrying in the wake of recent high profile cyber breaches in the UK already this year. Cyber-attacks are a major problem and it’s time for Boards to take a proactive stance on this. Companies need a clear, coherent, adaptive strategy which encompasses people, processes and technology, and this mandate needs to come from the top.”
Dr. Guy Bunker, SVP Products at Clearswift added: “Any such strategy needs to understand how critical information might leave your company network, starting with the custodians of your data – and this must include anyone that interfaces with your data, so ‘your extended enterprise’; including employees, contractors and third party data handlers’. Who has access to what sensitive data, and should they? How do they share data? Will they take company data with them when they leave? What would happen if a company phone was left on a train? Could any of them be tempted to sell data? These types of questions help you understand the risks and deploy proactive solutions to mitigate them. The Clearswift Insider Threat Index will help companies understand the true nature of the risk, how likely employees are to lose data, and how the changing nature of work affects the risks, so they can develop an informed, companywide strategy.”
“Companies with good, existing data protection habits and a well thought through data security policy are in better shape to survive a breach, whether internal or external. The insider threat represents a ticking time-bomb for businesses and one, it seems, that they are unprepared for. With the ‘insider threat intelligence’ provided by the CITI report, those responsible for keeping critical information secure can get inside the mind-set of their ‘enemy within’ well enough to create a playbook of approaches that helps them defend against both inadvertent and premeditated actions that could compromise their most critical of information.”
