In today’s world, information security is a recurring feature in the news. With businesses relying on IT systems more than ever, it’s increasingly important to be aware of the information security risks and what you can do to protect your organisation.

But what are the top five causes of information security breaches?

1. Malicious or accidental actions from internal staff

Last year, 60% of all organisations in the UK alone experienced a security breach and surprisingly half of these were carried out by the actions of internal staff for example employees accidentally leaving confidential information on a train, or in some cases, maliciously leaking information.

2. Viruses

The most common example of external attacks is through computer viruses. These are attached to seemingly innocent e-mails or programs accidentally taken in to work by staff on infected USB devices. Once opened, they can re-write key parts of the system to either maliciously damage the company's ability to continue to work or to grant external access to confidential information.

3. Phishing

Phishing scams are also quite common. This is where e-mails are sent from individuals external to the company, pretending to be from a legitimate source and requesting confidential information (such as personal customer details). These may also contain a web-link which directs the staff member to an exact copy of a common website (such as an online bank they use). Once they enter their log in details they have effectively given this information to the external person who can then access their account.

4. Hacking

Hacking is where individual users use specialised written software to attack a company’s systems, often trying to re-write system access to allow them to read and obtain confidential data.

5. Denial of service attacks

A threat that is becoming more prevalent these days is a denial of service attack. This is an attack on an organisation’s system which prevents the system from operating until the attack is stopped (usually after a 'ransom' is paid). With businesses relying on their IT systems more than ever it’s crucial to ensure that controls are in place to manage and reduce risks of security breach.

So what can you do about this?

Most companies now have anti-virus checks in place and perform regular system scans. These can cut out the majority of viruses and some security software can also detect hacking software too, providing they are kept up to date. Denial of service attacks require adequate firewall protection and a robust business continuity plan to mitigate the risks. With these solutions in place the risks of a breach is reduced (although not totally removed).

However, addressing the risk from Phishing or deliberate breaches from staff require businesses to implement a control framework to detect such activity. This ranges from specialised software to monitor e-mail traffic (which is not always welcome with staff), training staff to raise awareness, logging and monitoring of high risk activities (such as changing access rights or making program changes to key applications) and benchmarking controls against best practice standards to see where gaps might be.

Need more information?

For more information about these issues or advice on how your organisation can address them please do not hesitate to get in touch with me, Andrew Davidson, on 01738 634 001 or by email at Andrew.davidson@jcca.co.uk