DTI survey reveals firms are still failing to adopt necessary security controls to protect information

UK businesses are failing to adopt the necessary security controls to protect customers’ information, according to the latest Department of Trade and Industry (DTI) survey.

The biennial Information Security Breaches Survey, which was conducted by a consortium lead by accountancy firm PwC revealed that increasing volumes of business being conducted online have raised the priority given to protecting customer data.

According to the survey, most large organisations appear to have adopted best practice regarding network and data security and 78 per cent of those who accept financial transactions now encrypt the data they receive to ensure its confidentiality and integrity. However smaller firms are less likely to provide the required protection: fewer than a third encrypted the data they received.

Nine-tenths of respondents recognised that protecting customer information was important or very important and a strong justification for security expenditure and a strong justification for security expenditure. This has become one of the biggest drivers for IT security spending.

Andrew Beard, the director from PwC leading the survey, said: “It is encouraging that companies recognise the value of secure e-commerce to their business, however some still have work to do to put secure controls in place to satisfy their customers. Somewhat worryingly, the number of attacks on websites is rising and half of the attacks reported by respondents were described as serious.

“Clearly it is important that companies review the controls they have in place and ensure sensitive information is protected and encrypted. As more and more businesses adopt VOIP technology, it is imperative that they also consider the risks associated with this new technology and don't leave anything to chance," he said.

Ed Gibson, chief security advisor at Microsoft UK, said: "E-commerce provides infinite opportunities for UK businesses, but also provides opportunities to criminals targeting business networks for financial gain. Online transactions can be secure today with the right levels of protection; as long as organisations and end-users use security best practice and the technology tools available to them. The survey highlights that although progress is being made, UK businesses still need regularly review and reassess their security status to continue to increase customer confidence online."