Committing available resources to the threats that occur most often and can cause the greatest damage will allow small enterprises to create better IT security without breaking the bank.

Recently, Info-Tech Research Group conducted a survey designed to gauge organizational IT security maturity. A component of the survey involved investigating security incident information, specifically regarding the following threats:

• Malware attacks
• Externally-sourced breaches
• Internally-sourced breaches

This note will help enterprises understand the magnitude of the IT security threats they face and use that information to build appropriate and efficient IT security.

Trend Point

In a recent survey on IT security maturity within organizations, Info-Tech Research Group asked a series of questions about the security incidents that had been experienced within the last 12 months. These questions focused on the nature of the breaches as well as the frequency of their occurrence. The data yielded by the questions is highly indicative of the threat scenarios that enterprises of all sizes face on a daily basis, and understanding these scenarios is essential to protecting against them.

Situation Analysis

For the purposes of the survey, three different types of threats were defined:

• Malware attacks
• Breaches from external sources
• Breaches from internal sources

Figure 1 below shows the number of enterprises that suffered from these attacks. The data is broken down to show ranges of how often a given attack type occurred (once, two to four times, five times and greater).

Leading the way with a frequency of 55 percent (i.e., the attack type was reported by 55 percent of the respondents) were malware attacks. Clearly, viruses, worms, Trojan horses, and the like continue to be a significant security threat. The least frequent type of attack was external breaches, though 15 percent experienced firsthand the work of a hacker or other cyber-criminal. Rounding out the survey data, almost 42 percent of enterprises reported a breach originating from employees. Though security professionals have been preaching for years that insiders are a greater risk than hackers, the fact that internal breaches occur with almost the same frequency as malware attacks is still somewhat surprising and alarming.

When one looks at the chart, the malware bar as a whole represents 55 percent of the total respondent pool, the external breach bar as a whole represents 15 percent of the total respondent pool, while the internal bar represents 42 percent of the pool as a whole. So, with a total pool of 175 respondents, 96 experienced a malware breach, 26 experienced an external breach, and 73 experienced an internal breach. You can verify these numbers by comparing with the values on the y axis.

Figure 1: Threat Incidence Frequency (Click images to enlarge.)

Source: Info-Tech Research Group

Of particular interest from the above figure is the high number of internally sourced breaches. To help make the data clearer, the responses have been broken into two categories: those breaches that occurred through malicious actions and those that occurred as a result of employee error. This information, as well as the comparative data for external breaches, is shown separately in Figure 2.

Figure 2: Breach Incidence Frequency

Source: Info-Tech Research Group

When the data is expanded in this way, it can be seen that the most significant cause of data breaches is employee error. The fact that mistakes lead to breaches should not be surprising, but what should be is that they lead to almost 10 percent more breaches than malicious actions and hacker attacks combined. While most organizations have been reticent to implement internal security controls because of the belief that such actions indicate a lack of trust, this data indicates that trust is neither earned nor well-founded. Further, when the malicious action data is compared with the external hacker data, it can be seen that the figures are essentially identical. Thus, even if the breaches that are caused by mistakes are discounted, insiders are still responsible for as many breaches as hackers. Given that no enterprise would completely ignore externally-sourced threats, it is clearly inappropriate to ignore internally-sourced threats.

To demonstrate the impact that organizational size has on threat frequency, the data pool was further divided into three distinct groupings:

• Small enterprise (up to 250 employees)
• Mid-sized enterprise (between 251 and 1,000 employees)
• Large enterprise (greater than 1,000 employees)

The N-counts for the three groupings were roughly equivalent, although the large enterprise category was represented by slightly more respondents. While the medium and large enterprises are of little concern in this note, the full data set is presented in Figure 3 for the sake of comparison.

Figure 3: Impact of Organization Size on Threat Occurrence

Source: Info-Tech Research Group

This view of the data shows only the number of individual enterprises that were affected by the listed threats, omitting frequency, but is instructive nonetheless. For small enterprises, malware threats are reported as having occurred slightly more often than for larger companies.

The three percentage point increase in malware occurrence is far less concerning than the equivalent three percentage point increase in occurrence of external breaches versus larger organizations. That more small enterprises are experiencing external breaches is likely indicative that these enterprises have lesser perimeter defenses in place due to resource unavailability (money and skilled staff). Internal breach figures also exceed those of mid-sized companies but fall short of the levels experienced by the largest companies in this survey.

Info-Tech Predicts

By extending the data analysis to take into account the number of incidents that the reporting enterprises experienced, the approximate number of attacks that occurred can be calculated. By then comparing this figure with both the number of respondents as well as the number of attacked enterprises, we can calculate the likelihood of one of these types of attacks occurring. Attack count was determined by totaling the number of enterprises that experienced a single breach, the number of enterprises that experienced two to four breaches times three (the mid-point of the bracket), and the number of enterprises that experienced five or more breaches times five. As such, the figure is an approximation, and the actual count may be lower but is more likely to be higher.

By comparing the values we calculate from this procedure to the number of respondents, we can extrapolate that enterprises will experience 1.68 malware attacks per year, or one attack and a 68 percent chance of a second attack. For external breach and internal breach, the frequency per respondent is 0.31 and 1.09 respectively. Thus, the average enterprise will experience one malware attack, one phishing attack, and one internal breach annually with a strong likelihood of a second malware attack, a moderate chance of an external breach, and the slim possibility of a second internal breach. This data is presented in Table 1. Also shown in this table is the frequency with which attacks occurred within the enterprises that reported them. Interestingly, even though the number of attacks by category varied significantly (as per Figure 1), their frequency range was much tighter.

Table 1: Count and Frequency of Attacks by Breach Type

Source: Info-Tech Research Group

When mid and large-sized companies (those with 251 employees and greater) are extracted from this data set, more accurate predictions per company size can be made. This data is presented below in Table 2.

In terms of the threats that face small companies, all threats occur at a slightly lower frequency than in the overall average. The greatest delta is noted for malware attacks, though again, the difference is minimal. These reductions indicate that small organizations will on average experience less than three incidents a year, almost half of which are likely to be actual breaches.

Table 2: Count and Frequency of Attacks by Breach Type, Small Companies

Source: Info-Tech Research Group

Key Takeaways

1. 1. Like death and taxes, security incidents are a certainty. Although not all organizations surveyed reported a security incident, the count and frequency of those that were experienced suggest it's just a matter of time. Statistically speaking, across the four basic categories surveyed, the average small company will experience approximately three security incidents a year, at least one of which will likely be an actual breach.
2. 2. Attacks by malicious employees are almost as common as those by hackers. Enterprises typically focus the vast majority of their security expenditures on perimeter protection, leaving the network wide open to insiders. Although this does keep the number of external threats low, the fact that malicious internal threats equal external means that internal protection is required. Further, this protection should be net additive, rather than a redirection from perimeter protection. Otherwise, a "robbing Peter to pay Paul" situation is likely to ensue.
3. 3. Employee error is the problem that needs the most attention. Given that employee error accounted for more breaches than malicious action and hacker attacks combined and that breaches put the enterprise at far greater risk of loss than malware or phishing, enterprises should focus on eliminating these problems. Education and training is the primary requirement, but technical controls such as Data Leakage Protection (DLP) can also help.
4. 4. The larger the enterprise, the greater the risk. While the average small enterprise can expect about three security incidents a year, survey data shows that as these enterprises grow toward the upper end of the size bracket, they could experience as many as two more threats every 12 months.
5. 5. Refine ROSI values with the calculated attack frequency figures. One of the primary variables in any Return On Security Investment (ROSI) calculation is Annual Rate of Occurrence (ARO). Plugging these numbers into the ROSI formula will yield more accurate figures than AROs derived at by guesstimating.

Bottom Line

Understanding the nature of the IT security threats to which smaller enterprises are exposed is critical in formulating an appropriate protection plan. Committing available resources to the threats that occur most often and can cause the greatest damage will allow small enterprises to create better IT security without breaking the bank.