Nearly Half of Organizations Cite Employees as Biggest Risk

The more things change, the more they stay the same. While the nature of the technology employees use has dramatically changed over recent decades – from immovable desktops connecting to internal networks to iPads and netbooks with the ability to work anywhere — insiders and employees have remained among the greatest risks. According to the 2018 Netwrix Cloud Security Report, which consists of a survey of 853 various-sized organizations, industries and geographical locations. All organizations are public or hybrid cloud users.

According to the survey, 45 percent of organizations perceive their own employees to be the biggest security risk. Even though the majority of attacks they experienced over the year were external, organizations blame their own IT staff, 39 percent, and business users 33 percent, as much as or more than their cloud providers which is 33 percent. "Although most actual security attacks were external, cloud customers mostly blame their own users for incidents in the cloud and see them as the biggest threat to security,” said Michael Fimin CEO of Netwrix in a statement.

Fimin explained that even if insiders are not malicious, they still can unwittingly help attackers get into the environment, whether due to a lack of knowledge about risks, negligence or mistakes.

Further, organizations do not perceive themselves as being ready to address the insider threat because they have only partial visibility into activity in their IT infrastructures, a situation that has not changed much since 2016. The share of organizations that have complete visibility into the activity of IT staff sits at 28 percent, business users 17 percent, third parties with legitimate access, 12 percent, and providers, 9 percent, is low and needs to be improved.

Here are some other key findings in the report:

• The most common cloud security concerns remain the same: the risk of unauthorized access 69 percent, the risk of malware infiltrations at 50 percent and the inability to monitor the activity of their own employees in the cloud at 39 percent. 
• Only 66 percent of surveyed IT teams have top management's support for security initiatives for the cloud. 
• It’s 42 percent of organizations that are ready to embrace the cloud more fully, while 47 percent are not ready for one or more reasons. Even though 86 percent of organizations said in 2016 that they were not ready for a big cloud move. One year later, however, 31 percent of respondents say they are planning a complete migration to the cloud in the next five years. 
• The majority of organizations plan to start storing sensitive data in the cloud or move more data there. Mainly it is going to be customer 50 percent, employee 45 percent, and financial 37 percent information. 
• What are organizations planning to do to improve their security posture: Employee training 55 percent, enforcement of stricter security policies at 53 percent and deployment of vendor security solutions at 39 percent.

As Jai Vijayan wrote in his Dark Reading story, Insider Threat Fear Greater Than Ever, Survey Shows, despite ever-increasing spending on monitoring data access, organizations remain vulnerable to insider risks. “In a survey of 508 security professionals conducted for Haystax Technology by LinkedIn’s Information Security Community and Crowd Research Partners, 74% of the respondents say their organizations are vulnerable to insider threats. That's a 7% increase from last year's survey by the groups conducting the research,” Vijayan wrote.

“Nearly 60% of the respondents in the Haystax survey point to inadequate data protection strategies as contributing to an increase in insider threats. The increasing number of devices with access to sensitive data, and the increasing use of mobile devices to store and access sensitive data, are also considered major factors to the increase in insider threats,” he wrote.

The Haystax survey also found that 56 percent reported that insider threat events are now more frequent than the previous year.