Click here to close now.

SYS-CON MEDIA Authors: Yeshim Deniz, Pat Romanski, Carmen Gonzalez, Liz McMillan, Roger Strukhoff

News Feed Item

IT Security Professionals Say That the Overwhelming Majority of Security Risks Are the Result of Human Error or Attack, While Only Half of Their Budgets Are Spent to Defend Against Them

BalaBit eCSI Report Survey Conducted at RSA Conference 2014 Underlines That It Is Time to Allocate IT Security Budgeting According to Real, Human Threats

NEW YORK, NY -- (Marketwired) -- 03/25/14 -- BalaBit IT Security (www.balabit.com), a global leader in the development of privileged activity monitoring, trusted logging and proxy-based gateway technologies today announced its latest eCSI Report survey results.

Conducted among nearly 300 attendees at the recent RSA Conference in San Francisco, the survey results show that 84 percent of IT security related losses can be attributed to human elements (such as human error, sophisticated internal or external attackers) with the remaining 16 percent related to infrastructure issues (system malfunction, automated attack). The survey noted that, when it comes to budgeting, the ratio is balanced: only 55 percent of budgets are spent for managing human risk and 45 percent for infrastructure risk.

Companies still concentrate their IT security resources on infrastructure security and external risk factors. Respondents ranked the main risk factors according to their share of IT budgets in the following order:

  • 30 percent prioritized external attackers above all other risks
  • 28 percent said system malfunctions are most important
  • 17 percent said automatic attacks
  • Protection against human errors and internal attackers were a top budget priority for only a small minority of respondents (13 percent and 12 percent, respectively)

But, when IT security threats were ranked in order of potential costs, results show a very different picture:

  • 51 percent of those surveyed said that human errors cause the greatest financial loss
  • 18 percent for external attackers
  • 15 percent for internal attackers
  • 9 percent for system malfunctions
  • 7 percent for automated attacks

"The biggest difference that our survey revealed is that IT professionals clearly see that human errors cause 51 percent of their losses. But when they are planning their budget, only 13 percent of them put preventing human errors at the top of the list and even 40 percent of respondents ranked human errors as least important. If companies are aiming to spend their IT security budget responsibly, it's high time to do away with this commonly held fallacy," said Zoltán Györkő, CEO of BalaBit IT Security.

IT security experts not only need to build and maintain secure IT systems, but also need to ensure business continuity and support users do their job. RSA Conference attendees were asked to estimate how much the level of their IT security at their company is reduced by satisfying the needs of special users. 83 percent of respondents said that their security level is reduced (heavily 19 percent, notably 32 percent and moderately 32 percent), to accommodate special users.

"Access controls can be self-defeating. Because of their inflexibility, they are often not able to prevent breaches but restrict people from doing their jobs efficiently. Advanced monitoring can be effective tool against IT security risks related to human elements, regardless whether the source is external or internal. Human risks can be highly decreased by detecting and blocking suspicious user activities. Real time alerting and monitoring is inevitable for privileged accounts, which have rights to access, modify or delete sensitive company information, no wonder their credentials are the primary target for hackers. A higher rate of detection -- even during preparation -- is more deterrent than passive control and more business-friendly at the same time," Györkő added.

An infographic is available at http://bit.ly/1gDmsDz

BalaBit revealed the survey results at the recent Gartner Identity and Access Management Summit held in London.

About BalaBit

BalaBit IT Security is an innovative information security company, a global leader in the development of privileged activity monitoring, trusted logging and proxy-based gateway technologies to help protect customers against internal and external threats and meet security and compliance regulations. As an active member of the open source community, we provide solutions to a uniquely wide range of both open source and proprietary platforms, even for the most complex and heterogeneous IT systems across physical, virtual and cloud environments.

BalaBit is also known as "the syslog-ng company", based on the company's flagship product, the open source log server application, which is used by more than 1 million installations worldwide and became the globally acknowledged de-facto industry standard.

BalaBit, a fastest growing IT security software developer company based on Deloitte Technology Fast 50 CE Lists, where BalaBit has been included four times in the fast five years. The company has local offices in France, Germany, Russia, and in the USA, and cooperates with partners worldwide. Our R&D and global support centers are located in Hungary, Europe.

For more information, visit www.balabit.com.

Media Contact:
Dan Chmielewski
Madison Alexander PR
Office +1 714-832-8716
Mobile: +1 949-231-2965
Email Contact

More Stories By Marketwired .

Copyright © 2009 Marketwired. All rights reserved. All the news releases provided by Marketwired are copyrighted. Any forms of copying other than an individual user's personal reference without express written permission is prohibited. Further distribution of these materials is strictly forbidden, including but not limited to, posting, emailing, faxing, archiving in a public database, redistributing via a computer network or in a printed form.

Latest Stories
Container frameworks, such as Docker, provide a variety of benefits, including density of deployment across infrastructure, convenience for application developers to push updates with low operational hand-holding, and a fairly well-defined deployment workflow that can be orchestrated. Container frameworks also enable a DevOps approach to application development by cleanly separating concerns between operations and development teams. But running multi-container, multi-server apps with containers ...
Software development, like manufacturing, is a craft that requires the application of creative approaches to solve problems given a wide range of constraints. However, while engineering design may be craftwork, the production of most designed objects relies on a standardized and automated manufacturing process. By contrast, much of moving an application from prototype to production and, indeed, maintaining the application through its lifecycle has often remained craftwork. In his session at Dev...
Software Development Solution category in The 2015 American Business Awards, and will ultimately be a Gold, Silver, or Bronze Stevie® Award winner in the program. More than 3,300 nominations from organizations of all sizes and in virtually every industry were submitted this year for consideration. "We are honored to be recognized as a leader in the software development industry by the Stevie Awards judges," said Steve Brodie, CEO of Electric Cloud. "We introduced ElectricFlow and our Deploy app...
SYS-CON Events announced today that DragonGlass, an enterprise search platform, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. After eleven years of designing and building custom applications, OpenCrowd has launched DragonGlass, a cloud-based platform that enables the development of search-based applications. These are a new breed of applications that utilize a search index as their backbone for data...
Converging digital disruptions is creating a major sea change - Cisco calls this the Internet of Everything (IoE). IoE is the network connection of People, Process, Data and Things, fueled by Cloud, Mobile, Social, Analytics and Security, and it represents a $19Trillion value-at-stake over the next 10 years. In her keynote at @ThingsExpo, Manjula Talreja, VP of Cisco Consulting Services, will discuss IoE and the enormous opportunities it provides to public and private firms alike. She will shar...
Discussions about cloud computing are evolving into discussions about enterprise IT in general. As enterprises increasingly migrate toward their own unique clouds, new issues such as the use of containers and microservices emerge to keep things interesting. In this Power Panel at 16th Cloud Expo, moderated by Conference Chair Roger Strukhoff, panelists will address the state of cloud computing today, and what enterprise IT professionals need to know about how the latest topics and trends affec...
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo in Silicon Valley. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 17th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading in...
All major researchers estimate there will be tens of billions devices - computers, smartphones, tablets, and sensors - connected to the Internet by 2020. This number will continue to grow at a rapid pace for the next several decades. With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo, June 9-11, 2015, at the Javits Center in New York City. Learn what is going on, contribute to the discussions, and ensure that your enter...
SYS-CON Events announced today that EnterpriseDB (EDB), the leading worldwide provider of enterprise-class Postgres products and database compatibility solutions, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. EDB is the largest provider of Postgres software and services that provides enterprise-class performance and scalability and the open source freedom to divert budget from more costly traditiona...
In a recent research, analyst firm IDC found that the average cost of a critical application failure is $500,000 to $1 million per hour and the average total cost of unplanned application downtime is $1.25 billion to $2.5 billion per year for Fortune 1000 companies. In addition to the findings on the cost of the downtime, the research also highlighted best practices for development, testing, application support, infrastructure, and operations teams.
An entirely new security model is needed for the Internet of Things, or is it? Can we save some old and tested controls for this new and different environment? In his session at @ThingsExpo, New York's at the Javits Center, Davi Ottenheimer, EMC Senior Director of Trust, reviewed hands-on lessons with IoT devices and reveal a new risk balance you might not expect. Davi Ottenheimer, EMC Senior Director of Trust, has more than nineteen years' experience managing global security operations and asse...
The Internet of Things is a misnomer. That implies that everything is on the Internet, and that simply should not be - especially for things that are blurring the line between medical devices that stimulate like a pacemaker and quantified self-sensors like a pedometer or pulse tracker. The mesh of things that we manage must be segmented into zones of trust for sensing data, transmitting data, receiving command and control administrative changes, and peer-to-peer mesh messaging. In his session a...
Organizations today are confounded by an avalanche of data that needs to be processed and managed on a daily basis. Through relevant use cases and a thought-provoking dialogue on an organization’s ‘Data to Decisions’ journey, Andrew Clyne, Chief Data Officer at CenturyLink Cognilytics, will reveal in his session at Big Data Expo how your organization can monetize data as a strategic asset. State-of-the-art Big Data and Advanced Analytics capabilities provided as a managed service can enable da...
There is no doubt that Big Data is here and getting bigger every day. Building a Big Data infrastructure today is no easy task. There are an enormous number of choices for database engines and technologies. To make things even more challenging, requirements are getting more sophisticated, and the standard paradigm of supporting historical analytics queries is often just one facet of what is needed. As Big Data growth continues, organizations are demanding real-time access to data, allowing immed...
SYS-CON Events announced today that the "First Containers & Microservices Conference" will take place June 9-11, 2015, at the Javits Center in New York City. The “Second Containers & Microservices Conference” will take place November 3-5, 2015, at Santa Clara Convention Center, Santa Clara, CA. Containers and microservices have become topics of intense interest throughout the cloud developer and enterprise IT communities.