LONDON A survey has shown that ninety-nine percent of U.K. companies are still not implementing all the safeguards available to them to manage and control access for the right users to their systems and reduce the risk of crimes such as electronic identity theft.
The 2006 Department of Trade and Industry's biennial Information Security Breaches Survey, conducted by a consortium led by PricewaterhouseCoopers, shows only one percent of companies have in place all the pieces of the identity and access management jigsaw.
Overall, levels of identity management related incidents were consistent with 2004 when the last survey was carried out. Among large companies there was a small increase; in one in five, staff had gained unauthorised access to data. While the incidence of fraud was low, when it did occur, it tended to have a worse impact than any other type of security breach – particularly in terms of reputation damage, adverse media coverage and cost of remediation. Several small businesses reported direct losses of £10,000 to £50,000 as a result of fraud.
The telephone survey of 1,000 companies showed that compliance with laws and regulations has become the key driver (90 percent) for managing and controlling systems access, taking over from reducing cost of user access management and enabling new ventures over the internet.
More businesses are using strong authentication techniques such as hardware tokens or digital certificates than ever but single factor authentication continues to prevail with 80 percent of companies still relying on passwords alone.
Software tokens, where a small file is placed on a user's computer, have been adopted by many firms as a relatively cheap way of increasing security with telecoms and technology companies are the highest adopters of this method while businesses using stronger forms of authentication such as biometrics had fewer security incidents than those using software tokens and certificates alone.
Nearly a fifth of large businesses reported staff gaining unauthorised access to data while six percent suffered impersonation or phishing attacks.
The survey showed, however, that where organisations did have all identity and access management safeguards in place, none reported a single identity-related security incident. The full results of the survey will be launched at Infosecurity Europe in London April 25 – 27.
The consortium managing the 2006 survey is led by PricewaterhouseCoopers with other lead sponsors including Microsoft, Symantec, Entrust and Clearswift. Input has also come from the National Hi-Tech Crime Unit, Royal Holloway, University of London and the Information Security Forum.
A factsheet 'Identity and access management' can be downloaded.