The leading knowledge platform for the financial technology industry
The leading knowledge platform for the financial technology industry

A-Team Insight Blogs

SailPoint Global Market Pulse Survey Underscores Risk of Insider Threats

A recent SailPoint Market Pulse Survey examined the current state of employee compliance with corporate policy related to private, sensitive data to help identify weak links in IT risk mitigation programs. Conducted by Harris Interactive on behalf of SailPoint, the survey of 3,484 employees in the United States, Great Britain and Australia found that an alarming number of employees are exposing their companies to internal sabotage and theft.

To help prevent one of the most challenging types of security breaches – “insider threats” – organizations need to fully understand “who has access to what” across their enterprises and put in place proper IT controls to ensure that access rights are appropriate. SailPoint’s Market Pulse Survey underscores this very real risk to organizations: 22% of US, 29% of Australian and almost half of British (48%) employees who have access to their employer’s or client’s private data, and who answered the question, indicated they would feel comfortable doing something with that data, regardless if that access was intentional or accidental. Further, 10% of American, 12% of Australian and 27% of British employees with access admitted they would forward electronic files to a non-employee, and 9% of Americans, 8% of Australians and 24% of Britons of these same groups admitted they would copy electronic data and files to take with them when they leave a company.

“Organizations should be very concerned about the number of employees that openly admitted to misusing proprietary data,” said Jackie Gilbert, vice president of marketing and cofounder at SailPoint. “These results show that insider threats represent a significant risk to the business. Some of the biggest and most costly data breaches have been directly tied to company employees. Having a written policy is not enough to ensure data security. Organizations need to have automated controls in place to monitor and manage user access controls in order to minimize the risk of insider theft or sabotage.”

SailPoint’s Market Pulse Survey also questioned if an employee would feel comfortable profiting from proprietary information by selling it on the Internet. While only 5% of American and 4% of Australian employees with access who answered the question selected this response, an alarming 24% of British employees with access said they would feel comfortable selling data. Added Gilbert: “Unfortunately, it’s quite easy these days for employees to sell personal data on the Internet and there are not enough controls in place to prevent this theft from happening. It’s startling to see such a high number of Great Britain employees saying they would profit from selling proprietary data on the Internet. That’s a wake up call that companies need to take a more aggressive stance, particularly in certain geographies.”

Identity governance enables companies to manage the risk of insider threats while allowing necessary access for employees by strengthening an organization’s controls over both permanent employee and contractor access privileges. Identity governance minimizes risk by eliminating high-risk accounts, proactively detecting and remediating policy violations, and automating the review of user access privileges on a regular basis to ensure they align with corporate policy.

In addition to surveying employees about access to private, sensitive data, the SailPoint Market Pulse survey also asked them about accessing corporate date through the use of mobile devices. The results highlight the importance of automatically de-provisioning employees given the proliferation of mobile devices in the workforce. Specifically, 15% of American, 29% of British and 18% of Australian employees use their mobile devices to access their company’s private Intranet or portals.

“Mobile devices can make it easier for a disgruntled employee to do a significant amount of damage,” said Gilbert. “If an employee has just been fired, it’s no longer sufficient to turn off email and confiscate their laptop. A disgruntled employee can do a lot of damage from a mobile device before he or she even reaches the elevator. As part of a successful identity governance strategy, companies must have the ability to immediately revoke all access privileges including access to private Intranet or portals.”

Related content

WEBINAR

Recorded Webinar: Getting ready for Sustainable Finance Disclosure Regulation (SFDR) and ESG – what action should asset managers be taking now?

Interest in Environmental, Social and Governance (ESG) investment has exploded in recent years, bringing with it regulation and a requirement for buy-side firms to develop ESG strategies and meet disclosure obligations. The sell-side can help here by integrating ESG data with traditional financial information, although the compliance burden remains with asset managers. The EU Sustainable...

BLOG

Alveo Extends ESG Data Management Capability

Alveo (formerly Asset Control) has expanded its ESG data management capability by extending its standard industry data model and user interface to help clients understand ESG data quality, data lineage and divergence between third-party ratings. Driven by regulations such as the EU’s Sustainable Finance Disclosure Regulation (SFDR), the Alveo data model now incorporates the data...

EVENT

TradingTech Summit London

TradingTech Summit London will explore how trading firms are innovating in today’s cloud and digital based environment to create flexible, scalable trading platforms to support speed to market and business agility. Leveraging the cloud, AI and ML technologies to get an edge, automate processes and simplify operations in a cost effective way is the name of the game and will share practical insight from practitioners and technology leaders who are innovating and driving forward change in trading operations.

GUIDE

ESG Handbook 2021

A-Team Group’s ESG Handbook 2021 is a ‘must read’ for all capital markets participants, data vendors and solutions providers involved in Environmental, Social and Governance (ESG) investing and product development. It includes extensive coverage of all elements of ESG, from an initial definition and why ESG is important, to existing and emerging regulations, data challenges...