The Dark Side of the Web: Reducing the Threat from Within

By Stephanie Jordan
in

The 2009 Annual Study: Cost of a Data Breach, conducted by Ponemon Institute and sponsored by PGP Corporation, has revealed a shift in insider breaches. According to the report: Negligent insider breaches have decreased in number and cost most likely resulting from training and awareness programs having a positive affect on employees’ sensitivity and awareness about the protection of personal information.

“From the perspective of a CISO, the insider threat is a somewhat more contained problem than the burgeoning cybercrime threat,” believes Phillip Dunkelberger, CEO of PGP Corporation. “The last few years have shown that enterprises can limit their exposure to insider threats somewhat through a combination of education and judicious use of technology.”

Malicious or criminal attacks account for 24 percent of data breaches resulting in the loss or theft of personal information, found the report. This type of breach is much more expensive than incidents resulting from negligence. “Accordingly, in 2009 the per capita cost of a data breach involving a malicious or criminal act averages $215 USD. In contrast, the per capita cost of a data breach involving a negligent insider or a systems glitch averages $154 USD and $166 USD, respectively.”

After a data breach has occurred in an organization, the report found that training and awareness programs lead companies’ efforts to prevent future breaches according to 67 percent of respondents. Other remediation following a breach incident includes: additional manual procedures and controls (58 percent), expanded use of encryption (58 percent), identity and access management solutions (49 percent), data loss prevention solutions (42 percent), and endpoint security solutions (36 percent).

What’s Next?

With the evolution of the Web and the move toward cloud computing, are more data breaches anticipated? When asked to speculate, Dunkelberger replied that while predicting data breach trends is difficult, he expects that as “enterprise applications and data move to ‘the cloud’, we’ll certainly begin to see reported breaches based on the vulnerabilities hackers find there. The key in thinking about this issue, however, is to recognize that there isn’t just one cloud. There are and will continue to be many clouds providing different services to enterprises and individuals. Some will be more secure than others and each service provider bears the responsibility to ensure the security and integrity of the data they manage for their customers.”

Dunkelberger sees a unique opportunity in the transition to cloud-based computing. “For the first time we have the opportunity to build in security from the start of a major information technology architectural change. In fact, because of what enterprises have already learned about the risks and costs associated with data breaches, many will delay their cloud computing transitions until they can ensure the security of the data and services in the cloud(s). As such, data security will become a business enabler, rather of playing it’s historical role simply being one of many IT cost centers.”

Published February 25, 2010