Cloud and Mobility Complicate Security
Cloud computing, mobility, social tools and other technologies that put mor e power in the hands of individual users pose new challenges for organizations seeking to secure data, devices and networks, new research released today by CompTIA, the non-profit association for the information technology (IT) industry, reveals.
This was the big take-home from the latest Information Security Trends study by Computing Technology Industry Association (CompTIA). Among the 308 security breaches reported by participants in the 10th annual study, 54% were caused by human error. Nearly half those errors (49%) were attributed to end-user failure to follow policy and procedure. The study is based on a survey of 508 IT and business and IT executives directly involved in setting or executing information security policies and processes for their organizations; and 368 executives at U.S. IT firms, with most having some level of involvement in the IT channel.
“As users gain more responsibility for their own technology, the human element becomes more and more important,” said Seth Robinson, director, technology analysis, CompTIA.
“There’s a growing need that we see to educate the end users and bring them up to speed with security awareness, and [increase] their knowledge of what an attack might look like,” said study author Seth Robinson. “Educating the end user really should be a bigger priority.”
The message doesn’t seem to be getting through to the people in charge of enterprise security. About 60 % of survey respondents cited malware, such as viruses and Trojans, as a “serious concern.” Other types of security threats from the outside, namely hacking (54%), also outranked human error as major threats. Indeed, only 24% of respondents viewed end-user error as a “serious concern.” The respondents’ focus on external threats does not surprise Robinson. “It’s what they’ve been concerned about for years, and it informs how they’ve built and continue to build security defenses.”
Robinson attributes the disconnect between resource allocation and rising internal threats to both stagnant budgets and an outdated understanding of what constitutes adequate end-user training. A basic run-through of security policies at the time of hire with a yearly refresher isn’t enough, he said. Today, the advice from top information security experts calls for training that is frequent and interactive. For example, Robinson said a simulated phishing attack among the workforce can be a useful training tool. IT can track the number of employees who click the link, and give those employees additional information security training to recognize that type of threat.
A net 49 percent of companies say they intend to hire security specialists, including those that also plan on training current staff. Executives have a strong preference for security professionals with industry certifications. A full 84 percent said they experienced a positive return on investment in security certifications,
with certified staff viewed as more valuable because of their proven expertise and ability to perform at a high level than non-certified staff. Putting employee security training in the hands of a security specialist — and off the to-do list of CIOs — is something experts
strongly advocate. Decisions about device and platform management and application access should be made by infrastructure and operations (I&O) teams. However, security experts should be the ones figuring out what threats their organizations face from different end-user access scenarios.