printer friendly version

UK companies still risk electronic identity theft

A new survey has shown that 99% of UK companies are still not implementing all the safeguards available to them to manage and control access for the right users to their systems and reduce the risk of crimes such as electronic identity theft. Just 1% of companies have all the pieces of the identity and access management jigsaw in place, according to findings from the 2006 Department of Trade and Industry's biennial Information Security Breaches Survey, conducted by a consortium led by PricewaterhouseCoopers LLP.

The 2006 DTI Information Security Breaches Survey aims to raise awareness among UK companies and public sector organisations of the value of effective information security management.

The survey was conducted between October 2005 and January 2006 and is based on 1000 telephone interviews with organisations of all sizes across the UK, plus a series of face to face interviews with information security officers to supplement the telephone interviews. It is part of the Department of Trade and Industry's work with British industry to understand the impact of information security breaches.

The survey showed, however, that where organisations did have all identity and access management safeguards in place, none reported a single identity-related security incident.

Overall, levels of identity management related incidents were consistent with 2004 when the last survey was carried out. Among large companies there was a small increase; in one in five, staff had gained unauthorised access to data. While the incidence of fraud was low, when it did occur, it tended to have a worse impact than any other type of security breach - particularly in terms of reputation damage, adverse media coverage and cost of remediation. Several small businesses reported direct losses of £10 000-50 000 Euro as a result of fraud.

Key findings from the telephone survey of 1000 companies include:

* Compliance with laws and regulations has become the key driver (90%) for managing and controlling systems access, taking over from reducing cost of user access management and enabling new ventures over the Internet.

* More businesses are using strong authentication techniques such as hardware tokens or digital certificates than ever - one reason why the number of incidents has not risen more.

* However, single factor authentication continues to prevail with 80% of companies still relying on passwords alone.

* Software tokens, where a small file is placed on a user's computer, have been adopted by many firms as a relatively cheap way of increasing security - telecoms and technology companies are the highest adopters.

* Businesses using stronger forms of authentication such as biometrics had fewer security incidents than those using software tokens and certificates alone.

* Nearly a fifth of large businesses reported staff gaining unauthorised access to data while 6% suffered impersonation or phishing attacks.

* More firms are now using electronic requests (typically e-mail) to notify changes to access rights; in a quarter of large businesses, authorisation of a user request now triggers the automatic set-up of access rights (so-called user provisioning).

* However, 92% of companies do not have fully automated user provisioning, which provides security and efficiency benefits, leaving systems wide open to abuse through unauthorised access.

Andrew Beard, the director from PricewaterhouseCoopers LLP leading the survey, said: "Identity theft and phishing are on the increase, particularly in financial services and telecoms providers. Several businesses reported daily attacks of this nature. It is all the more important, therefore, that companies adopt an integrated approach to identity and access management; those that have, are seeing real benefits from their investment. At the moment, regulatory compliance is the key driver of security expenditure rather than the business opportunities to be derived from it.

"Too many companies are still relying on single factor authentication techniques such as user ID and passwords. More companies need to follow the lead of the few larger businesses which are using stronger methods to authenticate their users."

Share this article:

Further reading: