Survey Finds Many Companies Unaware of Security Risks

A significant number of the IT administrators surveyed in a recent poll said their companies don’t have a clear understanding of the security risks they face.

The survey, conducted by risk assurance company Courion, found that 33 percent of the IT decision makers admitted that their employers don’t have an accurate assessment of internal or external risks. Courion (News - Alert) pointed to two reasons for this lack of awareness.

First, 23 percent of the companies highlighted in the survey don’t have a formal IT risk management program in place. Second, many of the businesses don’t regularly review user access rights to corporate data.

More than 90 percent of the IT admins polled said that reviewing user access to data is a key aspect of their risk management plans. But 60 percent said they review user access only once a year or even less. And 45 percent said they don’t regularly examine user access to high-risk data. According to Courion, this lack of regular security reviews can lead to excessive user rights and unwanted access by privileged users.

Further, businesses that do conduct user access reviews invariably find some holes.

Almost half (48 percent) of the companies surveyed uncovered excessive user rights to data. Thirty-nine percent found inappropriate access by privileged users. And 56 percent said they discovered situations in which access was still in place for an employer’s previous job.

As always, the company doing the survey has a vested interest in the results since Courion sells risk assessment and assurance services. But the results should still ring an alarm bell for IT professionals.

Sometimes it’s easy for security to take a backseat to other day-to-day problems and priorities. But with the threats facing business today, that approach does put critical data in jeopardy. It’s important for IT administrators to keep security at the forefront and make sure they’re conducting regular security checks to keep their businesses and data protected.