Security Research - News and Highlights

Key findings include:

• Dimension Data survey shows organisations believe user errors will lead to data leakage
  57% of the organisations in our research are planning investment in data loss (or leakage) prevention (DLP) which shows a broad acceptance of the need to complement the traditional network-centric security approach with data-centric security. Organisations believe that data leakage is more likely to occur through human error on the part of their own employees, rather than through intentional theft from outside. How can organisations deal with these challenges?
  
  
• Don't assume compliance equals security - electronic crime in the area of wireless networks and the Internet is expanding geometrically
  IT security breaches in recent years have highlighted the fact that compliance with certain legislation and regulations does not necessarily equate to being secure. The scale of electronic crime in the area of wireless networks and the Internet is expanding geometrically. An American retailer lost 45 million credit card details as a result of electronic crime. The hacker was charged with two further hacking offences bringing to over 130 million, the total number of card details stolen. One of the victims - a payment card processing company - passed a PCI-DSS audit the month before card details were stolen from its systems.
  
  
• Organisations starting to invest in IT security strategy - enterprises planning to invest in IT security audits, data loss prevention (DLP), and consulting
  Investments in IT continue, even with IT-budgets in turmoil (41 % of surveyed organisations are reducing their IT spend in 2009). Could more be made out of the money spent…? Organisations are starting to realise the value of taking a pro-active approach to IT security. Those security solutions with the highest penetration in most market segments are anti-X, firewall/VPN, and content filtering. However, the surveyed companies are shifting their investment focus away from point- to more holistic solutions, with 59% planning to invest in IT security audits, 57% in data loss prevention (DLP), and 52% in consulting.
  
  
• Organisations set to spend more to prevent identity theft
  Organisations expect their highest future security technology investments to be in the prevention of identity theft and abuse, followed by incidents resulting from an external cause, unintentional privacy breaches, remote access abuse, and spam attacks. Organisations are tackling threats reactively, on an ad hoc basis, and without putting some basic security controls in place. In our experience, it really doesn't matter how sophisticated point solutions are: if organisations haven't implemented the five major categories of security control - firewall, intrusion prevention, system security, web content security, and email content security - then they're focusing on 20% of the risk, but leaving themselves exposed to the other 80%.