Spotlight on Internal Vulnerability

Wednesday, December 10, 2014 @ 05:12 PM gHale

Once the focus fell mainly on sophisticated external attacks, but now internal vulnerability and negligence fall under the spotlight of security professionals as a new study found 71 percent of employees said they have access to data they should not see, and more than half said this access is frequent or very frequent.

Most organizations are having difficulty balancing the need for improved security with employee productivity demands, according to a new survey by the Ponemon Institute. Employees with needlessly excessive data access privileges represent a growing risk for organizations due to accidental and conscious exposure of sensitive or critical data.

Breach: When Minutes Count
Data Breach Awareness on Rise
Malware Creation Skyrockets in Q3
ICS Targeted in Malware Campaign

The survey ended up based on interviews conducted in October with 2,276 employees in the United States, United Kingdom, France, and Germany. Respondents included 1,166 IT practitioners and 1,110 end users in organizations ranging in size from dozens to tens of thousands of employees, in a variety of industries including financial services, public sector, health & pharmaceutical, retail, industrial, and technology and software.

“Data breaches are rampant and increasing,” said Dr. Larry Ponemon, chairman and founder of the Ponemon Institute, a research center. “The sheer growth of both digital information and our dependence on it can overwhelm organizations’ attempts to protect their sensitive data. This research surfaces an important factor that is often overlooked: Employees commonly have too much access to data, beyond what they need to do their jobs, and when that access is not tracked or audited, an attack that gains access to employee accounts can have devastating consequences.”

IT practitioners and end users are witnessing a lack of control over employee access and use of company data, and the two groups generally agree their organizations would overlook security risks before they would sacrifice productivity.

Only 22 percent of employees surveyed believe their organizations as a whole place a very high priority on the protection of company data, and less than half of employees believe their organizations strictly enforce security policies related to use of and access to company data. Further, the proliferation of business data is already negatively impacting productivity — making it harder for employees to find data they truly need and should be able to access, and to share appropriate data with customers, vendors and business partners.

Other key findings on control and oversight include:
• 71 percent of end users say that they have access to company data they should not be able to see.
• 54 percent of those end users who have access they shouldn’t characterize that access as frequent or very frequent.
• 4 in 5 IT practitioners (80 percent) said their organizations don’t enforce a strict least-privilege (or need-to-know) data model.
• 22 percent of employees said their organization is able to tell them what happened to lost data, files or emails.
• 48 percent of IT practitioners said they either permit end users to use public cloud file sync services or permission is not required.
• 73 percent of end users believe the growth of emails, presentations, multimedia files and other types of company data has very significantly or significantly affected their ability to find and access data.
• 43 percent of end users say it takes weeks, months or longer to get access to data they request access to in order to do their jobs, and only 22 percent report that access is typically granted within minutes or hours.
• 60 percent of IT practitioners said it is very difficult or difficult for employees to search and find company data or files they or their co-workers have created that isn’t stored on their own computers.
• 68 percent of end users said it is difficult or very difficult to share appropriate data or files with business partners such as customers or vendors.

The findings also find IT practitioners and end users agree the compromise of employee accounts can lead to external data breaches that are most likely to end up caused by insiders with too much access who are frequently unaware of the risks they present. Fifty percent of end users and 74 percent of IT practitioners believe insider mistakes, negligence or malice are frequently or very frequently the cause of leakage of company data. And only 47 percent of IT practitioners said employees in their organizations take appropriate steps to protect the company data they access. When permissions management and auditing capabilities are not in place, employees’ excessive access to data and their negligence for security are increasingly putting company data at risk.

Other key findings on root causes of data breaches include:
• 76 percent of end users said their job requires them to access and use proprietary information such as customer data, employee records, financial reports, and confidential business documents.
• 38 percent of end users report they and their co-workers can see “a lot of data” they believe they should not have access to.
• 47 percent of IT professionals said end users in their organizations are taking appropriate steps to protect company data accessed by them.
• 76 percent of end users believe there are times when it is acceptable to transfer work documents to their personal devices, while only 13 percent of IT practitioners agree.
• 49 percent of IT practitioners said it is not likely or there is no chance that when documents, files or emails are lost or change unexpectedly, the organization will be able to assess what happened to them.
• 67 percent of IT practitioners said their organization experienced the loss or theft of company data over the past two years, while only 44 percent of end users believe this has happened.

“These findings should be a wake-up call to any organization that stores information about its customers, employees or business partners, which means almost any business or institution in today’s world,” said Yaki Faitelson, Varonis Co-Founder and chief executive. “There has been so much focus and investment on protecting the perimeter, but the most fundamental building blocks of security that protect the data inside – access controls and auditing – are often left behind. Unnecessary access combined with a lack of auditing capability adds up to inevitable disaster. Now we see that lack of control and oversight is impacting employee productivity as well, as they struggle to find and get access to data and share it easily and securely with business partners.”

Leave a Reply

You must be logged in to post a comment.