|
99% of firms ignore IT safeguards
18/03/06
Ninety-nine percent of UK companies are still not implementing all the
safeguards available to them to manage and control access for the
right users to their systems and reduce the risk of crimes such as
electronic identity theft, a new survey shows.
Only
1% of companies have in place all the pieces of the identity and
access management jigsaw, according to findings from the 2006
Department of Trade and Industry's biennial Information Security
Breaches Survey, conducted by a consortium led by
PricewaterhouseCoopers LLP.
The survey showed, however, that where organisations did have all
identity and access management safeguards in place, none reported a
single identity-related security incident. The full results of the
survey will be launched at Infosecurity Europe in London 25-27 April.
Overall, levels of identity management related incidents were
consistent with 2004 when the last survey was carried out. Among large
companies there was a small increase; in one in five, staff had gained
unauthorised access to data. While the incidence of fraud was low,
when it did occur, it tended to have a worse impact than any other
type of security breach - particularly in terms of reputation damage,
adverse media coverage and cost of remediation. Several small
businesses reported direct losses of £10,000-50,000 as a result of
fraud.
Key findings from the telephone survey of 1,000 companies include:
* Compliance with laws and regulations has become the key driver (90
percent) for managing and controlling systems access, taking over from
reducing cost of user access management and enabling new ventures over
the internet.
* More businesses are using strong authentication techniques such as
hardware tokens or digital certificates than ever - one reason why the
number of incidents has not risen more.
* However, single factor authentication continues to prevail with 80
percent of companies still relying on passwords alone.
* Software tokens, where a small file is placed on a user's computer,
have been adopted by many firms as a relatively cheap way of
increasing security - telecoms and technology companies are the
highest adopters.
* Businesses using stronger forms of authentication such as biometrics
had fewer security incidents than those using software tokens and
certificates alone.
* Nearly a fifth of large businesses reported staff gaining
unauthorised access to data while six percent suffered impersonation
or phishing attacks.
* More firms are now using electronic requests (typically email) to
notify changes to access rights; in a quarter of large businesses,
authorisation of a user request now triggers the automatic set-up of
access rights (so-called user provisioning).
* However, 92 percent of companies do not have fully automated user
provisioning, which provides security and efficiency benefits, leaving
systems wide open to abuse through unauthorised access.
These findings are published in a factsheet - 'Identity and access
management' - sponsored by security software solutions provider
Entrust Inc.
Andrew Beard, the director from PricewaterhouseCoopers LLP leading the
survey, said:
"Identity theft and phishing are on the increase, particularly in
financial services and telecoms providers. Several businesses reported
daily attacks of this nature. It is all the more important therefore
that companies adopt an integrated approach to identity and access
management; those that have, are seeing real benefits from their
investment. At the moment, regulatory compliance is the key driver of
security expenditure rather than the business opportunities to be
derived from it.
"Too many companies are still relying on single factor authentication
techniques such as user ID and passwords. More companies need to
follow the lead of the few larger businesses which are using stronger
methods to authenticate their users."
Nick Gibson, editor
©
Copyright Screen-Studio.com 2006
|
