Over A Third Of Organisations Take Two Or Three Days To Detect A Breach

Only 40 per cent of retail and financial organisations feel that they could detect a data breach within a number of days.

According to research of 102 financial organisations and 151 retail organisations in the UK by Tripwire, 25 per cent of breaches go undetected for more than 24 hours, while 44 per cent admitted that their customer data could be better protected.

Speaking to IT Security Guru, Dwayne Melancon, chief technology officer for Tripwire said he thought that practitioners were “deluded” if they thought that they could detect a breach in 2-3 days, as really organisations were not detecting at all.

 “This is a false sense of security and they think that they are better than they are, as even a large organisation can be naive,” he said. “With a two-man IT shop, what does that mean?”

 The Tripwire research also found that 40 per cent of respondents felt that recent high profile cardholder breaches have changed the level of attention executives give to security, while 43 per cent of respondents said that PCI DSS was the backbone of their security program, and 36 per cent said it was at least relevant to half of their security program.

He said: “I think it gets down to being better at security than they are; bought silver bullet boxes that makes them secure and what is key for organisations is a leveraging indicator which will help them get better,  as well as an established monitoring programme that can detect quickly.

“You can detect quietly and look for changes to the repository and track the environment. It comes down to what is easy and acting before there is too much damage and what the breach looks like.”

Tim Erlin, director of IT security and risk strategy for Tripwire, said: “It is shocking to see the high level of confidence exhibited by respondents in the wake of the recent series of high-profile cardholder data breaches. Sixty per cent of respondents said they are confident that their security controls are able to prevent the loss of data files, but this confidence flies in the face of recent evidence to the contrary.”

Dan Raywood is editor of the IT Security Guru