False Sense of Security? Executives Confident about Readiness, but CompTIA Study Suggests New Threats May be Overlooked

DOWNERS GROVE, Ill., Nov. 19, 2013 /PRNewswire-USNewswire/ -- Organizations are overwhelmingly confident in their readiness to combat security threats, but may not be prepared for dangers linked to new technology models and increasingly sophisticated threats, according to a new study released today by CompTIA, the non-profit association for the information technology (IT) industry.

(Logo: http://photos.prnewswire.com/prnh/20130107/DC38135LOGO)

The overwhelming majority of companies (82 percent) surveyed for CompTIA's 11th Annual Information Security Trends study view their current level of security as completely or mostly satisfactory.

But just 13 percent of firms say they've made drastic changes to their security approach over the past two years. This at a time when organizations have embraced cloud computing; enabled employee BYOD practices; and expanded their use of social tools.

"The use of new technologies necessitates a change in security approach," said Seth Robinson, director, technology analysis, CompTIA. "It's clear why companies view security as a top priority; but what's less clear is whether they are fully aware of which actions to take to build an appropriate security posture for a new era of IT."

Levels of concern for a wide range of threats remains virtually unchanged from past years, too. Most companies still view hacking and malware as the preeminent threats. But a host of new dangers are quickly becoming more prevalent, including Advanced Persistent Threats, Denial of Service attacks, IPv6 attacks and mobile malware.

"To truly 'move the needle' on security readiness, the overall approach must be re-evaluated from the top level of the business down through all departments," Robinson continued.

Throughout the 11 years of the CompTIA study the human element has been a major factor in both security readiness and shortcomings. This year is no different. Human error accounts for the majority of root cause in security breaches; and 51 percent of companies say human error has become more of a factor over the past two years. This may be due in part to the introduction of cloud computing, mobility and social media into the enterprise.

Yet it's striking that few companies (21 percent) view human error as a serious concern.

"End users control powerful devices and business-class systems, often without the oversight of the IT team," said Robinson. "While they may be able to use these devices and systems, they typically do not have the background knowledge and experience with security that allows them to recognize potential threats."

CompTIA's 11th Annual Information Security Trends study is based on online surveys of 500 business and IT professionals in the United States involved in IT decision-making for their organizations; and 500 executives at U.S. IT channel companies.

More details from the study are available at http://www.slideshare.net/comptia/comptia-11th-annual-information-security-trends. The complete report is available at no cost to CompTIA members, who can access the study at www.CompTIA.org or by contacting [email protected].

SOURCE CompTIA