- DigitalPersona survey discovers a worrying trend, as the internal perimeter remains unguarded -

The threats to organisations from internal IT security breaches are being severely underestimated, recent survey figures have shown. DigitalPersona® conducted a survey of nearly 400 IT professionals at InfoSec 2012, highlighting a startling trend - of the 380 respondents, 61% believed that the majority of security breaches are a result of unintentional user activity, yet 60% of respondents stated that they didn’t have 2-factor authentication for their internal network.

A further 17% believe that intentional user activity is a cause of security breaches, which begs the following question: If almost 80% of the respondents believe security breaches are a result of user activity (intentional AND unintentional), why do 60% of respondents not have sufficient authentication to protect their internal network?

Ben Boulnois, EMEA director, DigitalPersona, believes it is an issue of business priorities: “The security of an internal perimeter is something that is often moved down the pecking order when it comes to budgetary priorities. The external perimeter is the first in line for attention as firewalls and other security measures take the lion’s share of the IT budget, and is still considered by senior decision makers as the main route of security threats.

“There is also the issue of the user impact – IT departments are often hesitant in implementing new, stricter authentication solutions which require user training. This incurs both monetary and time costs which in a large or time-pressed organisation can prove to be a factor against the use of multi-factor authentication.”

Another figure raised by the survey that correlates to this trend is the issue of users sharing credentials. 67% of respondents stated that they considered the sharing of access credentials, such as passwords, smart cards and tokens, to be a major concern. Sharing credentials erodes any reliable audit trail should an internal breach occur, effectively rendering them useless. Biometrics solutions such as fingerprint identification, offer one solution for organisations looking to prevent against breaches caused by unauthorised credential sharing.

“It is clear from the results of the survey that the industry recognises that the internal threat, intentional or otherwise, is a real risk, said Boulnois.

“However, the fact that there appears to be so few addressing the problem is worrying. The biggest IT security risk to any organisation is the employee, and companies need to put into place security policies that help to prevent the temptation to breach security. Multi-factor authentication provides support for both the prevention of an attack and the forensics in the aftermath of a breach, providing an effective solution. Companies must start to push the importance of the internal threat further up the IT security agenda.”