Remote access and wireless network points becoming focus of security breaches

June 2004 Information Security

More than half of UK businesses now provide their staff with access to their information systems over dial-up or the Internet. Among large companies the figure is 86%, up from 71% two years ago. Other 'enabling' technologies such as wireless networks have also mushroomed over the last two years, leading to a rise in security incidents and breaches which are of growing concern to business. Yet companies do not appear to be taking the threats seriously enough. These are among the initial findings from the 2004 Department of Trade and Industry's biennial Information Security Breaches Survey, conducted by a consortium led by PricewaterhouseCoopers LLP (UK).

Key findings from the survey of some 1000 companies include:

* All sizes of UK business have significantly increased their use of remote access since 2002 when the DTI Survey was last carried out; likewise a third of companies now have wireless networks compared to just 2% two years ago.

* Some 35% of businesses use Personal Digital Assistants (PDAs), 57% in the case of large businesses.

* Wireless networks are becoming a focal point for external attack, with 8% of businesses that have them reporting attempts at unauthorised access, while a significant number - 23% - say that they did not know whether they had been probed.

* For those companies that suffered attempts at unauthorised access, the number of incidents was low, with two-thirds reporting 10 or less, although one in seven identified over 100 attempts.

* Despite the obvious threats, it is not always the case that companies providing remote access deploy additional security controls - a quarter of businesses rely on their normal network password controls, despite the fact these are often easy to 'crack'.

* Large businesses tend to deploy better controls; twice as many had deployed a virtual private network (VPN), while three times as many used two-factor authentication or digital certificates.

* Similarly with wireless networks, only one in five of all companies used wired equivalent privacy (WEP) or other additional encryption, while surprisingly more than half of wireless networks had no additional security controls at all.

* Very few organisations have woken up to the risk posed by PDAs as indicated by the fact that 58% of businesses that use them have no security measures in place to protect the business data on them; large companies fare a little better, but even then 38% have no controls.

* Those controls that do exist are usually on usage policies rather than technological protection.

These findings are published in a fact sheet - 'Remote Access' which can be downloaded from www.security-survey.gov.uk, or www.dti.gov.uk/industries/information_security

According to Andrew Beard, the PricewaterhouseCoopers advisory director leading the survey, "Businesses seem to be dragging their feet when it comes to introducing security controls over remote access to their systems. There are several reasons for this. First, many of those who want remote access appear to be the least aware of the additional risks it entails and/or are senior people in the organisation and have the power to authorise it. Second, the majority of companies do not analyse their security incidents in a way that enables them to identify, which are caused by remote access. Lastly, awareness of the available security techniques is poor, leading to inappropriate security controls being deployed."

For more information contact Derek Nash, PricewaterhouseCoopers, 0944 20 7804 3058, [email protected]





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

NEC XON shares lessons learned from ransomware attacks
NEC XON Editor's Choice Information Security
NEC XON has handled many ransomware attacks. We've distilled key insights and listed them in this article to better equip companies and individuals for scenarios like this, which many will say are an inevitable reality in today’s environment.

Read more...
iOCO collaboration protection secures Office 365
Information Security Infrastructure
The cloud, in general, and Office 365, in particular, have played a significant role in enabling collaboration, but it has also created a security headache as organisations store valuable information on the platform.

Read more...
Cybercriminals embracing AI
Information Security Security Services & Risk Management
Organisations of all sizes are exploring how artificial intelligence (AI) and generative AI, in particular, can benefit their businesses. While they are still figuring out how best to use AI, cybercriminals have fully embraced it.

Read more...
A strong cybersecurity foundation
Milestone Systems Information Security
The data collected by cameras, connected sensors, and video management software can make a VMS an attractive target for malicious actors; therefore, being aware of the risks of an insecure video surveillance system and how to mitigate these are critical skills.

Read more...
Surveillance and cybersecurity
Cathexis Technologies Information Security
Whether your business runs a security system with a handful of cameras or it is an enterprise company with thousands of cameras monitoring sites across a multinational organisation, you must pay attention to cybersecurity.

Read more...
Cyber-armour for a healthcare industry under attack
NEC XON Information Security Healthcare (Industry)
Malicious actors have exploited compromised credentials, a clear and present danger when healthcare providers' reliance on remote access software allows adversaries to disguise themselves as legitimate users and gain unauthorised access to critical environments.

Read more...
Cybersecurity and AI
AI & Data Analytics Information Security
Cybersecurity is one of the primary reasons that detecting the commonalities and threats of what is otherwise completely unknown is possible with tools such as SIEM and endpoint protection platforms.

Read more...
What are MFA fatigue attacks, and how can they be prevented?
Information Security
Multifactor authentication is a security measure that requires users to provide a second form of verification before they can log into a corporate network. It has long been considered essential for keeping fraudsters out. However, cybercriminals have been discovering clever ways to bypass it.

Read more...
SA's cybersecurity risks to watch
Information Security
The persistent myth is that cybercrime only targets the biggest companies and economies, but cybercriminals are not bound by geography, and rapidly digitising economies lure them in large numbers.

Read more...
Cyber insurance a key component in cyber defence strategies
Information Security
[Sponsored] Cyber insurance has become a key part of South African organisations’ risk reduction strategies, driven by the need for additional financial protection and contingency plans in the event of a cyber incident.

Read more...