Majority of Businesses Failing to Apply IT Security Practices: Survey

A new study on IT security
best practices revealed an epidemic of security worst practices, with a
majority of organizations failing to adhere to simple data-protection
standards. The research revealed that many organizations are critically unaware of what
security practices are currently in place.

Venafi, a specialist in
enterprise key and certificate management solutions, in conjunction with
Echelon One, an IT security research company specializing in security programs
and guidance, today released the 2011 IT Security Best Practices Assessment.
Echelon One led the effort to establish a set of 12 best practices and worked
closely with Venafi to evaluate how well 420 enterprises and government
agencies implemented them.

The assessment evaluated
where organizations rank in the implementation of 12 IT security and compliance
best practices, ranging from how organizations leverage and manage encryption
to how often they conduct security awareness and training programs. The top
five best practices, their high failure rates, and recommendations for
mitigation include performing quarterly security and compliance training, which
had a failure rate of 77 percent, and encrypting all cloud data and cloud
transactions, which had a failure rate of 64 percent.

The third best practice
suggestion was to use encryption throughout the organization, which had a
failure rate of 10 percent, followed by having management processes in place to
ensure business continuity in the event of a CA (certificate authority)
compromise, which had a failure rate of 55 percent, and rotating SSH (Secure
Shell) keys every 12 months to mitigate the risk incurred by average two-year
employee-turnover rates of service. That best practice had a failure rate of 82
percent.

"The assessment
findings were startling. We suspected we would find that many organizations
were challenged, but we had no idea that failure rates would run this
high," said Bob West, founder and CEO of Echelon One. "The good news
is that with this information and free self assessment, organizations can see
where they rank in comparison to peers, and determine where weaknesses exist.
They can identify steps to significantly reduce security and compliance risks
by leveraging automated processes with multilayered data security strategies, including
managed encryption."

The assessment further
revealed that almost 100 percent of evaluated organizations had some degree of
security, compliance or operational risk.

When asked if their
organizations encrypted data stored in leading public clouds such as Google
Apps, Salesforce.com and Dropbox, 40 percent said they did not know. When asked
how often critical encryption assets such as SSH keys were rotated, 41 percent
responded that they did not know, and when asked if their organizations were
using encryption keys and certificates for data security and system
authentication, 10 percent said they were not.

"The biggest security
struggle organizations face today is managing the unknown—a.k.a. the
unquantified and unmanaged risks. Your best security assets can easily turn
into liabilities if not managed properly," said Jeff Hudson, CEO of
Venafi. "If this assessment demonstrates anything, it’s that IT and
security departments have got to gain greater visibility over all of their
security and compliance activities, and take steps to better understand and
manage them."