Numbers: Internal Threats vs. External Threats

A recent survey by Deloitte & Touche suggests that CSOs should evenly balance their defenses against both external and internal threats.

By Kathleen Carr

August 01, 2003 — CSO — Fear the disgruntled employee. This has long been the mantra of security executives who believed that an employee who went off the deep end was more likely than an external source to launch a network attack. But a recent survey by Deloitte & Touche suggests that CSOs should evenly balance their defenses against both external and internal threats.

As for the 61 percent of survey respondents who say they haven't been attacked, Christian Byrnes, Meta Group analyst, says, "they just don't know it yet. One of the primary functions of security tools is to detect security failures. It can be very comforting for a manager, especially a CIO, to simply not see what is there by deciding not to invest in the necessary tools that detect security failures. No investment equals no detection, which equals no admission of failure."

Only 39 percent of survey respondents said they were victims of a cyberattack

16% were attacked from an external source

13% were attacked from an internal source

10% were attacked from both internal and external sources

61% reported that they were not attacked

Source: Deloitte & Touche "2003 Global Security Survey"

Read more about data protection in CSOonline's Data Protection section.

Other stories by Kathleen Carr

• Print