Businesses 'risk GDPR breaches' as they underestimate threat from insiders
Businesses overestimate the danger of attacks from outside threat actors compared to the real threat which comes from the insider, raising the prospect of GDPR-related breaches, according to a survey from Netwrix.
It found a disconnect between the perception of risk compared to where the real risk was coming from, as respondents rated the threat from outside attacks as being around 50 percent of their organisational risk compared to the reality which shows that 73 percent of attacks originate from insiders.
Earlier this year, the government introduced the new Data Protection Act that not only hiked the maximum fines for erring organisations from £500,000 to £18 million or 4 percent of a firm's annual turnover, but also introduced several stringent regulations that organisations had to comply with to escape fines or loss of reputation.
Some of these requirements included the duty of organisations to obtain clear affirmative consent for the collection, storage, and processing of customer data, to appoint qualified data protection officers, to conduct data privacy impact assessments, and to notify authorities and customers about breach incidents within 72 hours of discovering such breaches.
Considering the level of fines involved that could threaten the very existence of a business, one would expect that organisations in the UK have taken firm and timely action to reduce their exposure not only to cyber-threats but also to regulatory action in the aftermath of successful cyber-attacks.
However, a survey carried out by Netwrix Corporation to assess how UK-based organisations are addressing major IT risks such as physical damage, intellectual property theft, data loss, data breach, system disruption and compliance penalties tells an entirely different story.
The survey, results of which have been compiled by Netwrix Corporation in its 2018 IT Risks Report, touched upon how organisations categorised their principal IT threats, how frequently they carried out risk assessments, how much visibility they had over stored data, whether they were confident of their incident detection capabilities, and whether they had incident response plans in place.
According to the survey, 73 percent, or nearly three in every four security incidents are caused by insiders such as business users, mid-level managers, departing employees, and IT team members, yet over 50 percent of employees consider external hackers as the most dangerous threat actors in terms of data breach, thereby signifying a major gap in perceived threats versus the real ones.
Many cyber-security experts would argue that a mix of efficient privilege access management, two-factor encryption, multi-stage authentication, and machine learning technologies should enable organisations to detect or prevent data breaches. Yet, the survey revealed that 35 percent of organisations update access rights in accordance with least privilege principle only once a year, 85 percent of them do not discard stale and unnecessary data, and security controls are rarely reviewed as required by best practices.
At the same time, only 21 percent of UK-based organisations carry out IT risk assessments regularly even though 80 percent of them have carried out the exercise only once, one in five organisations do not know where sensitive data is located and how employees deal with it, and only 35 percent of those surveyed said they have incident response plans in place and provide training to employees.
When asked if a majority of UK-based organisations are carrying out risk assessments, training employees in cyber-security, or strengthening their security controls just because they are required to do so, Tony Richards, group CISO at Falanx Group told SC Magazine UK that if the survey results are to be believed, then it demonstrates that a high number of organisations are not compliant with the DPA 2018 and the GDPR.
He said it is "worrying that less than a quarter of organisations are reviewing those assessments regularly".
"If over 60 percent of organisations don’t have defined incident response plans, it’s unlikely that they have implemented Personal Data Breach reporting processes and will fail to meet the 72-hour breach reporting requirements," he said.
According to Matt-Middleton Leal, EMEA general manager at Netwrix, even though GDPR has become a catalyst for UK companies to revise their security strategies, the majority of them still lack the support of their leadership teams to invest in building a holistic approach to cyber-security.
Industry: Cyber Security News
- Application Security Analyst
- Up to £85,000 Base
An Application Security Analyst is needed for an innovative commercial organisation in London. The Application Security Analyst will be working closely with the development team and should possess a blend of application security, development languages and Information Security skills. Application Security Analyst MUST have strong interpersonal skills. The Application Security Analyst role will include, but in no way be limited to; designing solutions to maintain security, whilst incorporating design solutions in Development, DevOps and Architectural best practices. Conduct application-level penetration testing and review security architecture of Product suite. Executing projects to implement a Security strategy. Knowledge / Experience should include; penetration testing consultancy, source code reviews, vulnerability management and security assessments. Experience with the following is desirable: Agile Development, Fortify 360 SCA, IBM Rational AppScan and exposure to security industry standards - ISO27001 and PCI-DSS. The ideal candidate will have 3 years’ experience in a similar Information Security role and have relevant security qualifications - CISM / CISSP or CISA etc. This is a client facing opportunity where you will be expected to travel to customer sites. Reference Number: OG7484 (Application Security, Penetration Testing, Information Security)
- Cloud Network Engineer
- Up to £35,000 Base + Bonus + Possible Share Options
One of our clients, an exciting UK based start-up is on the lookout for a Cloud Network Engineer in Yorkshire. The Cloud Network Engineer will need current CCNA / CCNP level networking experience (Cisco, BGP, IP etc.), cloud networking understanding (Azure, AWS etc.) and current experience ideally within a client facing / consultancy role. (Cloud Engineer, Network Engineer, Azure, AWS, Amazon Web Services) Reference Number: PG7477
- Senior Service Desk Analyst
- Up to £32,000 Base + £6,400 Shift Allowance
We are currently working on behalf of an IT Service Provider based in Wiltshire who are on the lookout for a Senior Service Desk Analyst. The Senior Service Desk Analyst will be responsible for logging, managing and escalating internal & external incidents and requests. This is an excellent opportunity to join a business recognised for what they do and work with a number of top UK businesses. You’ll be able to manage your career development and gain additional training e.g. certifications etc. This role will include a shift (4 days on then 4 days off) which covers 24/7 12 hour shifts The ideal candidate will be currently working in a IT service desk / IT support role ideally in an IT Services business. Reference Number: PG7476 (Service Desk Administrator, Analyst, Support, Service Desk Support, shift work, traning, Information Technology, Customer service, Customer support)
- Data Centre Service Delivery Manager
- Up to £50,000 + Package
A Data Centre Service Delivery Manager is needed to join a specialist connectivity provider in Hertfordshire. The company is going through a huge growth programme and this is an excellent opening for someone to join a business who are working with globally recognised organisations. You’ll be responsible for: Supporting the Commercial Director with management of existing and potential customers being the main point of contact. Maintaining and improving the company’s current and new services Customer relationship management Attending customer meetings in order to provide guidance to customers Keeping up a high quality level of service Updating appropriate documentation such as policy and procedures and making sure these are in place and followed Change and Incident management Service Level Agreements Experience required Must have current experience working in a Data centre environment in a Service Delivery role. An understanding of Data Centre technology and terminology. Experience of dealing with people of all levels within a business (Engineers to Board level) In return you'll have the ability to work in a cutting edge environment and work with a variety of well known international clients REF: PG7475