Most agencies unprepared for information theft by workers

As agencies spend billions of dollars a year attempting to secure their data from hacking, they confront another threat closer to home—data theft by their own workers.

That is one of the findings in a survey issued by management consultant Accenture and HfS Research on the day of Monday.

Of 208 agencies surveyed, 69% “experienced an attempted or realized information theft or corruption by corporate insiders” over the past twelve months, the survey discovered, compared with 57% that experienced similar activities from external sources. Media and technology firms, and enterprises in the Asia-Pacific region reported the highest amounts—77% and 80%, respectively.

 “Everyone’s always known that part of designing security begins with considering that your workers could be a risk, but I do not consider anyone could have said it was much that high,” stated Omar Abbosh, Accenture chief strategy officer.

Each year, businesses and agencies spend an assumed $84 billion to defend against information theft that charges them about $2 trillion, and that destruction could rise to $90 trillion a year by the year of 2030 if present trends continue, Abbosh predicted.

He suggested that agencies change their approach to cybersecurity by cooperating with competitors to establish joint strategies to outwit increasingly sophisticated cyber-criminals.

“There is a large business rationale to share and collaborate,” Abbosh stated. “If one bank is essentially violated in a way that ruins its trust with its customer base, I could be and say they are all going to come to me, but that is a false comfort (because) it pollutes the entire sphere of clients, because it makes everyone fearful.”

Despite recent high-profile information violations of Sony Corp., Target Corp. and the U.S. Office of Personnel Management, several agencies don’t yet think cybersecurity a top priority, Accenture found. Some 70% of the survey’s respondents stated that they lacked correct funding for technology, training or personnel required to sustain their company’s cybersecurity, while 36% claimed that their management considers cybersecurity “an unessential cost.”