Businesses 'risk GDPR breaches' as they underestimate threat from insiders

Businesses overestimate the danger of attacks from outside threat actors compared to the real threat which comes from the insider, raising the prospect of GDPR-related breaches, according to a survey from Netwrix.
It found a disconnect between the perception of risk compared to where the real risk was coming from, as respondents rated the threat from outside attacks as being around 50 percent of their organisational risk compared to the reality which shows that 73 percent of attacks originate from insiders.
Earlier this year, the government introduced the new Data Protection Act that not only hiked the maximum fines for erring organisations from £500,000 to £18 million or 4 percent of a firm's annual turnover, but also introduced several stringent regulations that organisations had to comply with to escape fines or loss of reputation.
Some of these requirements included the duty of organisations to obtain clear affirmative consent for the collection, storage, and processing of customer data, to appoint qualified data protection officers, to conduct data privacy impact assessments, and to notify authorities and customers about breach incidents within 72 hours of discovering such breaches.
Considering the level of fines involved that could threaten the very existence of a business, one would expect that organisations in the UK have taken firm and timely action to reduce their exposure not only to cyber-threats but also to regulatory action in the aftermath of successful cyber-attacks.
However, a survey carried out by Netwrix Corporation to assess how UK-based organisations are addressing major IT risks such as physical damage, intellectual property theft, data loss, data breach, system disruption and compliance penalties tells an entirely different story.
The survey, results of which have been compiled by Netwrix Corporation in its 2018 IT Risks Report, touched upon how organisations categorised their principal IT threats, how frequently they carried out risk assessments, how much visibility they had over stored data, whether they were confident of their incident detection capabilities, and whether they had incident response plans in place.
According to the survey, 73 percent, or nearly three in every four security incidents are caused by insiders such as business users, mid-level managers, departing employees, and IT team members, yet over 50 percent of employees consider external hackers as the most dangerous threat actors in terms of data breach, thereby signifying a major gap in perceived threats versus the real ones.
Many cyber-security experts would argue that a mix of efficient privilege access management, two-factor encryption, multi-stage authentication, and machine learning technologies should enable organisations to detect or prevent data breaches. Yet, the survey revealed that 35 percent of organisations update access rights in accordance with least privilege principle only once a year, 85 percent of them do not discard stale and unnecessary data, and security controls are rarely reviewed as required by best practices.
At the same time, only 21 percent of UK-based organisations carry out IT risk assessments regularly even though 80 percent of them have carried out the exercise only once, one in five organisations do not know where sensitive data is located and how employees deal with it, and only 35 percent of those surveyed said they have incident response plans in place and provide training to employees.
When asked if a majority of UK-based organisations are carrying out risk assessments, training employees in cyber-security, or strengthening their security controls just because they are required to do so, Tony Richards, group CISO at Falanx Group told SC Magazine UK that if the survey results are to be believed, then it demonstrates that a high number of organisations are not compliant with the DPA 2018 and the GDPR.
He said it is "worrying that less than a quarter of organisations are reviewing those assessments regularly".
"If over 60 percent of organisations don’t have defined incident response plans, it’s unlikely that they have implemented Personal Data Breach reporting processes and will fail to meet the 72-hour breach reporting requirements," he said.
According to Matt-Middleton Leal, EMEA general manager at Netwrix, even though GDPR has become a catalyst for UK companies to revise their security strategies, the majority of them still lack the support of their leadership teams to invest in building a holistic approach to cyber-security.
Source scmagazineuk
Industry: Cyber Security News

Latest Jobs
-
- Network Security Engineer
- Germany
- €550 a day
-
German- based contract opportunity This is an onsite based position, we would need the Network Security engineer to be able to work on the client site 5 days a week Seeking an experienced Network Security Engineer for a leading technology company. Strong expertise in firewall/IPS solutions, proxy solutions, and certificate management is required. Good hands-on experience in networking and web-related technologies necessary. Strong problem-solving skills and the ability to work under pressure are essential. we are looking for a Network Security Engineer with the following experience: · Expertise in Administration, Management & Troubleshooting of Firewall / IPS solutions / Proxy solutions/Certificate Management Solutions · Good Hands-on Experience on security devices (PaloAlto/ /McAfee Proxy/CISCO ISE/Certificate Management) · Good Hands-on Experience in Networking with skills of switching, routing & wireless Technologies · Familiarity with web related technologies (Web applications, Web Services, Service Oriented Architectures) and of network/web related protocol · Configuration of NAT / PAT, firewall policies, profiling, objects, AD-Integration, backup – restore · Knowledge of Subnetting TCP/IP Communication, VLSM Configuration of VLAN VTP · Configuration of Routing Protocols e.g. RIPv1 & v2, OSPF, EIGRP, BGP Knowledge of standard and extended ACL 12 month contract
-
- IAM Consultant
- N/A
- Upto £110,000 depending on level of position
-
Identity Access Management (IAM) Consultant Location: Germany We are seeking an experienced IAM consultants in Germany. we are looking for people from consultant through to Architect, The ideal candidate will have previous IAM deployment experience and be fluent in German. Key responsibilities: Design and implement IAM solutions for clients Provide expertise on industry best practices and standards Troubleshoot and resolve IAM-related issues Work closely with clients to understand their business requirements and provide solutions to meet those needs Qualifications: Previous deployment experience with IAM solutions Fluency in German Strong understanding of IAM technologies and principles Excellent communication and project management skills If you are an experienced IAM consultant with a strong track record of delivering successful projects, please apply today.
-
- ForgeRock Consultant
- Spain
- Upto €85000 plus benefits
-
ForgeRock deployment consultant is needed for this expanding IT Services business within Spain, to act as their ForgeRock technical lead, Responsibilities include: High level and low level design, Scoping the techical needs of the project design, configure, develop and test the forgeRock deployment. We are looking for a strong IAM consultant ideally with ForgeRock experience, Must have strong Oauth 2.0, SAML and API experience
-
- IAM Consultant
- France
- Upto €85000 plus benefits
-
An Identity & Access Management Consultant is needed for an expanding IT Security consultancy, based in France. (Remote role with monthly office meet-ups) The Identity & Access Management Consultant will be responsible for the technical design and implementation of Identity & Access Management/IAM products for a wide variety of clients. Deliver bespoke end-to-end consultancy service to our clients, from gathering requirements through to implementation. Work in a close team designing, developing, and implementing first-class IAM solutions. Manage client relationships, working closely with key stakeholders to continually evaluate business requirements and ensure the highest quality solution delivery. If you are interested we are looking for an individual with Previous experience working within the IAM or CIAM field is essential, Strong knowledge with SAML and Oauth and ideally OpenID Previous experience from any of these technologies: One Identity, SailPoint, Saviynt, Ubisecure, Ping Identity, would be advantageous