Netwrix conducted a study of the major IT risks that are significant for most organizations and assessed respondents’ readiness to withstand cyber threats.
The report is based on the feedback of 1,558 organizations of various sizes from many different regions and industries. It summarizes the experiences and plans the organizations have in regard to addressing six IT risks: physical damage, intellectual property theft, data loss, data breach, system disruption and compliance penalties.
The report reveals the following key findings:
- Most companies consider hacker attacks to be the most dangerous threat, but in fact, insiders cause the majority of security incidents by either malicious or accidental actions.
- Not all critical security controls are reviewed regularly as required by best practices. The most neglected controls include getting rid of stale and unnecessary data and conducting data classification. These controls are exercised rarely or never by 20% and 14% of organizations, respectively.
- Although 70% of companies have done IT risk assessment at least once, only 33% re-evaluate their IT risks regularly.
- 44% of respondents either do not know or are unsure of what their employees are doing with sensitive data.
- Nonetheless, over 60% of respondents think that their level of visibility is high enough, which lulls them into a false sense of security.
- Only 17% of organizations have an actionable incident response plan; 42% have only a draft or have no plan at all.
“Our report illustrates that the foremost reason why the organizations fail to address major IT risks lies in a lax approach to security basics. They are giving priority to some controls and are leaving the most important ones out of scope. Haphazard approach to security basics and poor visibility into sensitive data gives IT pros a false sense of security. However, paying more attention to all security basics can help organizations manage IT risks with more success,” said Steve Dickson, CEO of Netwrix.
You can read the original article, here.