Employees bigger cyber security threat than dedicated criminals

Over half of business leaders see their own employees as a bigger threat to cyber security than external attackers, according to the survey ‘Boardroom Cyber Watch 2013'.

The survey, delivered by IT Governance, collated the views of 260 senior executives from across the globe, representing organisations ranging in size and revenue from US $5 million to US $500 million. 

Perhaps surprisingly, despite recent high-profile cases of external hackers derailing government and corporation IT systems, employees are seen as the biggest threat to an organisation's cyber security - being the number one threat chosen by 53 per cent of respondents.

A more modest number, at 27 per cent, consider cyber criminals their number one threat. State-sponsored cyber-attackers (12 per cent) and rival organisations (8 per cent) followed.

Worryingly, a quarter of all respondents admit to facing a cyber attack in the last 12 months alone, whilst a further 20 per cent concede that an attack in the last year may have occurred. Despite this, only 30 per cent of the senior executives questioned properly value the need for an understanding of IT security vulnerabilities when hiring executive staff.

Alan Calder, Chief Executive of IT Governance, commented on the findings: “In the face of the rapid development and deployment of new cyber-threats, such infrequent executive oversight of IT security status seems alarmingly casual.

"In the boardroom, many companies still appear too removed from the action for directors to meet their governance obligations.”

To provide an incentive to brush up on cyber security, the survey has revealed that half of the companies have been asked by customers about information security measures in the past 12 months - a more proactive attitude that could provide a competitive advantage if followed.

Calder explained: “The best way for organisations to prove their cyber security credentials is to comply with, and be certificated against, ISO 27001, the global best practice standard for information security management. This lets you signal to customers anywhere in the world that you have a robust method for addressing the entire range of risks associated with systems, people and technology."

By: Information Daily Staff Writer