Survey: Nearly Half of Organizations Have a Consistent Enterprise Encryption Strategy

Nearly half of organizations have an enterprise encryption strategy that is applied consistently across the entire organization, a new encryption survey revealed. Forty-three percent of respondents to Thales’ “2018 Global Encryption Trends Study” said their employer had an enterprisewide encryption plan in place for 2017. That’s up from 41 percent in 2016 and 37 percent in 2015.

Enterprise Encryption Strategy Adoption on the Upswing

Thales began tracking the evolution of encryption back in 2005. In the 13 years that followed, the firm observed a steady increase in organizations adopting an encryption strategy. The company reported a decline in companies with no such strategy or plan over the same period: Just 13 percent of respondents said they lacked a comprehensive encryption policy in 2017, down from 15 percent two years prior.

Not all survey participants reported having a consistent plan across the entire organization, but the percentage of professionals with a limited enterprise encryption strategy didn’t change from 2016. Forty-four percent of respondents said their organization had a limited approach in both 2016 and 2017, which is up from just a quarter of individuals in 2015.

IT Security Spending on the Rise

For the study, Thales commissioned the Ponemon Institute to survey 5,252 individuals across industry sectors in the U.S., U.K. and 10 other countries. Their responses provided the company with insight into how enterprises’ use of encryption has evolved.

Their answers also illuminated how much budget employers are allocating to encryption and IT security. The former declined slightly from 14 percent in 2016 to 12 percent in 2017. At the same time, organizations spent approximately 10 percent of their overall IT spending on security, a percentage that marked a record high in a 13-year upward slope.

The report indicated some areas where both encryption and security spending could grow. One of them was cloud, with 21 percent of professionals expecting their organization to transfer sensitive or confidential data to the cloud within the next year or so. That’s in addition to the 61 percent of respondents who already do so.

Human Error an Ongoing Risk to Data

The Thales survey revealed that employee mistakes weighed heavily on respondents’ minds. Forty-seven percent of professionals cited human error as the most salient threat to sensitive or confidential data, followed by system or process malfunction and cybercriminals at 31 percent and 30 percent, respectively.

To protect against employee mistakes, organizations should balance technical controls with training that helps employees take responsibility for their actions.

David Bisson

Contributing Editor

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its C2 communication mechanisms, which include misusing the Internet-of-Things (IoT) messaging protocol MQTT. WailingCrab, also known as WikiLoader, is a sophisticated, multi-component malware delivered almost exclusively by an initial access broker that X-Force tracks as Hive0133, which overlaps with TA544. WailingCrab…

Operationalize cyber risk quantification for smart security

4 min read - Organizations constantly face new tactics from cyber criminals who aim to compromise their most valuable assets. Yet despite evolving techniques, many security leaders still rely on subjective terms, such as low, medium and high, to communicate and manage cyber risk. These vague terms do not convey the necessary detail or insight to produce actionable outcomes that accurately identify, measure, manage and communicate cyber risks. As a result, executives and board members remain uninformed and ill-prepared to manage organizational risk effectively.…

Pentesting vs. Pentesting as a Service: Which is better?

5 min read - In today's quickly evolving cybersecurity landscape, organizations constantly seek the most effective ways to secure their digital assets. Penetration testing (pentesting) has emerged as a leading solution for identifying potential system vulnerabilities while closing security gaps that can lead to an attack. At the same time, a newer entrant into the security arena is Pentesting as a Service (PTaaS). Although PTaaS shares some similarities with pentesting, distinct differences make them two separate solutions. This article will discuss how these methodologies…

Security Intelligence

{{title}}

{{title}}

{{title}}

{{title}}

Topics

Enterprise Encryption Strategy Adoption on the Upswing

IT Security Spending on the Rise

Human Error an Ongoing Risk to Data

More from

Unified endpoint management for purpose-based devices

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

Operationalize cyber risk quantification for smart security

Pentesting vs. Pentesting as a Service: Which is better?

Topic updates