Database security found lacking

A survey conducted by Application Security and the Ponemon Institute was released this week at the Gartner IT Security Summit.  The survey reveals that 40% of companies are not monitoring their databases for suspicious activity which places them at high risk for data breaches and identity theft.

According to the survey of 649 IT professionals (60% in CIO or CTO positions), 78% of respondents say their databases are critical or important to their business and contain customer data. IT professionals are increasingly strained by the demands for data and the threat of data breaches. On the one hand, data must be protected from external and internal threats and on the other hand, there is greater demand to this data to make business decisions.

With more than 50% of these organizations managing 500 or more databases, the number of companies not effectively monitoring their databases is staggering at a whopping 40%.

Some of the key problems facing respondents are the sheer number of databases being used and the difficulty of knowing where those databases are and what is in them…

According to Weiss, locating all of an organization’s databases is just one-fourth of the battle. Corporations need to prioritize which databases need to be addressed first, re-mediate any vulnerabilities or security issues and monitor databases for suspicious activity, he said. [eWeek]

As previous posts on this blog have indicated, “people” are the biggest concern IT professionals have when it comes to data security. 57% of respondents say they have inadequate protection against malicious insiders and 55% are not protected against data loss caused by insiders.

In general, only 45% of IT professionals felt adequately protected against data loss.

In addition, the survey indicates that companies are more concerned about securing their own data (intellectual property and confidential business information) than they are about securing their customers’ data.

Via InformationWeek & eWeek Tags: database security, data security, it security, data breach, data loss, data security, data protection