It is estimated that nearly 90 percent of all data breaches involve insider negligence, yet the results of a survey announced today by security software provider GFI Software revealed only 9 percent of small-medium businesses (SMBs) said they are concerned about internal threats. Further, the survey found that the threat posed by employees leaving the company with confidential data was of concern to only 26%, the lowest rated. This is a concern, especially in a down economy with layoffs and benefit cuts which tend to lead to more employees who are unsatisfied with their jobs. According to a report from the Ponemon Institute announced earlier this year, a data breach costs approximately$6 million per breach, an amount that would be crippling to most SMBs.

The full survey report is available for download at http://www.gfi.com/documents/SecurityReport2009.pdf.

Other GFI survey highlights include:

• The survey gives an indication of how threats are perceived by SMBs and their source: the IT security threats that most concern SMBs are accidental data corruption, malware attacks and external. Fifty-one percent (51%) said that they are concerned about Web-borne malware. However, only 9% said they are concerned about internal threats. The threat posed by employees leaving the company with confidential data was of concern to only 26%, the lowest rated.
• Nearly half of SMBs underestimate the impact uncontrolled access to the Internet can have on their organization – in terms of network security, productivity levels and HR.
• Although the majority of SMBs (61%) have security policies in place regarding Internet use, far fewer have the means to monitor and/or filter the HTTP traffic and lless than half (47%) say they have the means to do so
• Email compliance and eDiscovery appear to be low on the list of priorities for many of the respondents. When asked if they have rules or policies governing the storage and/or retention of emails, 63% said they did not have any rules stating where emails should be stored, however of those, 18% said they were planning to do so. On the other hand, 66% of respondents do not have email retention rules.
• Of those using Web filtering software, the majority (67%) said they use it for security against virus and malware downloads, 55% to prevent illegal and/or unacceptable Web browsing and only 36% to monitor employee browsing activity.

This survey was sponsored by GFI to assess the readiness of the small and medium businesses (SMBs) in the U.S. in dealing with security issues, and to determine how priorities in IT security have changed in the SMB market due to the current economic environment. The online survey was conducted among 540 IT professionals with decision-making authority or specific responsibility for IT security, and work at a SMB that has 500 or less employees.