Survey Finds Retail, Financial Industries 'Feeling the Heat' of Insider Threats
Close to 100 percent of the 408 surveyed IT decision-makers working in the retail and financial sectors said their organizations are vulnerable to insider threats, said the results of the 2015 Vormetric Insider Threat Report, released Tuesday. Some 97 percent…
Sign up for a free preview to unlock the rest of this article
Export Compliance Daily combines U.S. export control news, foreign border import regulation and policy developments into a single daily information service that reliably informs its trade professional readers about important current issues affecting their operations.
of U.S. financial services respondents said they were somewhat or more vulnerable to insider threats. For retail respondents, 93 percent said they were somewhat or more vulnerable to insider threats, with 51 percent of those saying they feel very or extremely vulnerable to insider threats. In the past 12 months, 48 percent of U.S. retail respondents and 41 percent of financial services respondents said they had experienced a data breach or failed a compliance audit. "Retailers and financial services organizations are feeling the heat,” said Vormetric CEO Alan Kessler. But the data shows “organizations are not connecting the dots about how to solve the problem,” because they continue to invest in network and endpoint security technologies that “consistently fail under today’s attacks,” he said. "Within the past 3-5 years, threats have changed dramatically and will continue to do so in the year ahead," said Andrew Kellett, author of the report. "Vulnerable sectors like the retail and financial industries need to understand that compliance standards evolve too slowly to keep up with fast moving threats, and even then ticking all the compliance boxes is no guarantee of safety.” The report said that IT security strategies must now include layered defenses combining traditional IT security solutions with advanced data protection techniques, have both secure on-premise databases and remote cloud resources, use data encryption, tokenization, data masking and other techniques that de-identify data, and implement a monitoring system that identifies data usage and unusual and malicious access patterns.