BUSINESSES in the Midlands are worryingly complacent when it comes to information security, a new report suggests.
According to the report from PricewaterhouseCoopers, too many organisations adopt a “it won’t happen to me” approach, while individuals often tend to think “it is someone else’s problem.”
The business adviser said organisations should make employees the first line of defence against damaging security incidents.
The report, entitled Security awareness: Turning your people into your first line of defence, suggests that the response of organisations to improving protection and reducing risks has been strongly biased towards further investment in technology. In essence, they have been solving what are perceived to be technical issues with technical solutions.
Neil Ward, information security specialist at PwC in the Midlands, said the approach was misguided.
“Technical solutions are too frequently being prescribed for people problems. Although technical defence is vital, systems are inherently vulnerable to both negligent and malicious acts by people. Ignorance, confusion, anger or even curiosity can all give rise to security incidents,” he said.
The report considers whether information security has currently got the right focus, and is backed up by PwC’s 2010 Global State of Information Security Survey, which shows that only 48% of organisations questioned in the UK have an employee security awareness programme, falling behind global leaders – the United States (64%) and India and Australia (59%).
It said efforts to improve security often created cumbersome processes that got in the way of people doing their jobs. Consequently, they could be tempted to bypass security controls, reducing the effectiveness of technical solutions.
What is required, suggests the report, is a new approach in which investment in understanding and influencing the behaviours of staff is balanced against continued investment in technology.
The firm said the difficulty large organisations often face is that security functions tend to be autonomous, fragmented and isolated while ignorance can provide a false sense of security among a workforce.
PwC recommends that better engagement between security teams and the business is needed as well as higher levels of engagement between organisations and employees.
It said the ideal solution was to invest in people – making them the first line of defence rather than the cause of security incidents.
The benefits and return on investment from a strategy that leads people to exhibit new behaviours around information security will exceed misdirected investment in technology-based security solutions, it added.
“The goal is that all those working for an organisation are alert to risks, will want to act to protect information and will be actively supported in doing so,” said Mr Ward.
“As the first line of defence, security-aware employees are often best placed to identify a potential breach or weak link. Equally, they can prevent and reduce the impacts of incidents when they do occur.”
PwC said investment in security awareness and associated behavioural change measures paid for itself many times over and could help in:
• reducing incidents of theft, loss and fraud; • avoiding breaches of law and/or regulation; • ensuring continuous availability of business-critical information; • protecting brand and reducing the potential for reputational risk; and • enabling the use of security as a positive marketing differentiator.
