The 2006 Department of Trade and Industry's biennial information security breaches survey, conducted by a consortium led by PricewaterhouseCoopers says that only one per cent of companies have all the pieces of the identity and access management jigsaw in place.
Over all, levels of identity management related incidents were consistent with 2004 when the last survey was carried out. Among large companies there was a small increase: in one in five, staff had gained unauthorised access to data. While the incidence of fraud was low, when it did occur, it tended to have a worse impact than any other type of security breach, particularly in terms of reputation damage, adverse media coverage and cost of remediation. Several small businesses reported direct losses of £10,000-50,000 as a result of fraud.
Key findings from the telephone survey of 1,000 companies include:
- compliance with laws and regulations has become the key driver (90%) for managing and controlling systems access
- more businesses are using strong authentication techniques, such as hardware tokens or digital certificates than ever - one reason why the number of incidents has not risen more
- single factor authentication continues to prevail, with 80% of companies still relying on passwords alone
- software tokens, where a small file is placed on a user's computer, have been adopted by many firms as a relatively cheap way of increasing security
- businesses using stronger forms of authentication, such as biometrics, had fewer security incidents
- nearly a fifth of large businesses reported staff gaining unauthorised access to data, while six per cent suffered impersonation or phishing attacks
- more firms are now using electronic requests (typically e-mail) to notify changes to access rights; in a quarter of large businesses authorisation of a user request now triggers the automatic set-up of access rights (so-called user provisioning)
- 92% of companies do not have fully automated user provisioning, leaving systems wide open to abuse through unauthorised access.
