Human Error Cited As Greatest Security Risk

In Deloitte's sixth annual Global Security Survey, people are the problem.

"[P]eople continue to be an organization's greatest asset as well as its greatest worry," Adel Melek, global leader of security and privacy services at Deloitte Touche Tohmatsu, said in the report. "That has not changed from 2007. What has changed is the environment. The economic meltdown was not at its peak when respondents took this survey. If there was ever an environment more likely to facilitate an organization's people being distracted, nervous, fearful, or disgruntled, this is it. To state that security vigilance is even more important at a time like this is an understatement."

On one level, that couldn't be more obvious: It's not as if anyone worries about squirrels hacking servers; security has always been about people. (Robots, the report says, are unlikely to replace the human workforce during the lifetime of anyone reading the report. Finally, some good employment news.)

Yet despite the obviousness of the problem, the obvious solution -- complete denial of access -- doesn't work. People use computers and computers are more useful when connected and it just gets worse from there. That may explain why identity and access management remained top of mind for survey respondents.

Deloitte's survey, drawn from major financial companies around the globe, focuses on governance, investment, risk, use of security technologies, quality of operations, and privacy. It includes some good news -- external breaches have declined sharply over the past year -- and troublesome news -- fewer companies say they have the commitment and funding to address regulatory compliance.

In terms of risk, specifically information systems failure, people are identified as the most significant vulnerability. "Human error is overwhelmingly stated as the greatest weakness this year (86%), followed by technology (a distant 63%)," the report states. It attributes the rising risk to increased adoption of new technologies and social networking.

In 2008, data breaches caused by human error declined, the Identity Theft Resource Center said last month. Nonetheless, such breaches accounted for 35.2% of incidents with reported causes.

Survey respondents cited viruses and works, e-mail attacks, and phishing/pharming as the most common cause of repeated occurrences of external breaches. But organizations are clearly getting better at dealing with these threats because the percentage of companies reporting repeated incidents arising from these causes fell last year.

External breaches arising from viruses and worms affected 15% of respondents in 2008 and 43% in 2007; external breaches arising from e-mail attacks affected 24% of respondents in 2008 and 57% in 2007; breaches arising from phishing/pharming affected 7% in 2008 and 38% in 2007.

Only 20% of respondents said they hadn't been affected by a breach arising from an external attack; only 30% said they had not been affected by a breach through an internal attack.

Viruses and worms also led the list among causes for internal breaches, affecting 11% of respondents.

The report observes that while organizations have made progress preventing repeat attacks arising from viruses/worms, they have been less successful in dealing with e-mail attacks and phishing/pharming. The reason is because e-mail attacks are more varied and because e-mail can't just be shut down.

"Organizations need to continue to figure out ways to thwart these threats if the Internet is to be a trusted communications medium," the report says.