October 28, 2009
Committing available resources to the threats that occur most often and can cause the greatest damage will allow small enterprises to create better IT security without breaking the bank.
Recently, Info-Tech Research Group conducted a survey designed to gauge organizational IT security maturity. A component of the survey involved investigating security incident information, specifically regarding the following threats:
Malware attacks
Externally-sourced breaches
Internally-sourced breaches
This note will help enterprises understand the magnitude of the IT security threats they face and use that information to build appropriate and efficient IT security.
Trend Point
In a recent survey on IT security maturity within organizations, Info-Tech Research Group asked a series of questions about the security incidents that had been experienced within the last 12 months. These questions focused on the nature of the breaches as well as the frequency of their occurrence. The data yielded by the questions is highly indicative of the threat scenarios that enterprises of all sizes face on a daily basis, and understanding these scenarios is essential to protecting against them.
Situation Analysis
For the purposes of the survey, three different types of threats were defined:
Malware attacks
Breaches from external sources
Breaches from internal sources
Figure 1 below shows the number of enterprises that suffered from these attacks. The data is broken down to show ranges of how often a given attack type occurred (once, two to four times, five times and greater).
Leading the way with a frequency of 55 percent (i.e., the attack type was reported by 55 percent of the respondents) were malware attacks. Clearly, viruses, worms, Trojan horses, and the like continue to be a significant security threat. The least frequent type of attack was external breaches, though 15 percent experienced firsthand the work of a hacker or other cyber-criminal. Rounding out the survey data, almost 42 percent of enterprises reported a breach originating from employees. Though security professionals have been preaching for years that insiders are a greater risk than hackers, the fact that internal breaches occur with almost the same frequency as malware attacks is still somewhat surprising and alarming.
When one looks at the chart, the malware bar as a whole represents 55 percent of the total respondent pool, the external breach bar as a whole represents 15 percent of the total respondent pool, while the internal bar represents 42 percent of the pool as a whole. So, with a total pool of 175 respondents, 96 experienced a malware breach, 26 experienced an external breach, and 73 experienced an internal breach. You can verify these numbers by comparing with the values on the y axis.
To view the complete article, click here.
Tags: budget cuts, disaster recovery, Global IT disaster recovery survey, info-tech research group, IT budgets, IT security
