Study: Endpoint Security Gaps Leave Organizations Vulnerable
Promisec Ltd. recently revealed findings from audits performed at 30 large organizations covering 193,000 corporate endpoints. The results from the findings indicate the prevalence of unauthorized software, rogue processes and endpoint security gaps have the potential for significant security issues at the nation's largest organizations.
Findings of the Promisec summary audit conducted over the last twelve months revealed 25,090 (13 percent) of the corporate PCs surveyed had unauthorized USB devices attached, opening the door to data loss and the opportunity for USB-borne viruses and malware to enter the corporate network. 7720 (4 percent) of corporate PCs had peer-to-peer (P2P) applications installed. 2895 (1.5 percent) of the corporate PCs did not have the latest Microsoft service packs, and 3281 (1.7 percent) had anti-virus monitoring and remediation issues. 2316 (1.2 percent) of the 193,000 audited endpoints were without required third-party desktop security agents. Finally, 1582 (0.8 percent) of endpoints had unauthorized remote control software, and a lesser percentage had unauthorized and unprotected shareware.
As revealed in these findings, data loss and illegal software introductions are the two largest threats, driven by the unauthorized connection of USB-attached mass storage devices.
"Organizations are becoming more adept at identifying security threats to their external networks, but internal network security issues represent a substantial problem for businesses challenged with preventing loss of corporate IP and the infiltration of their networks by malware inadvertently introduced by employees and business partners," said Amir Kotler, CEO of Promisec. "The answer to this problem is first understanding the magnitude of it. The loss of internal financial data, customer lists and proprietary product details can be devastating while the introduction of malware can significantly slow down business efficiency -- all of which can be prevented by implementing a strong endpoint security strategy."