Tighter budgets, a greater concern over internal security breaches due to lower employee morale and complacency after a decrease in overall attacks over the past year may expose global financial institutions to an increased risk of data breaches, according to Deloitte Touche Tohmatsu's sixth annual survey of global financial institutions' information security efforts.

Survey's major findings

While 60 percent of respondents confirm that their information security budgets increased in 2008 (mostly in the range of 1 to 5 percent), Steinhoff expects 2009 budgets to be down given cost containment efforts. More than half of respondents (56 percent) say that budgetary constraints and/or lack of resources are the leading barriers to ensuring information security, while lack of resources is identified by a third as the leading cause of failure of information security projects.

Security attacks that exploit human error and breaches caused by distracted or disgruntled employees may be the root cause of information security failures in coming months. The majority of respondents (86 percent) confirm that human error is the leading cause of information systems failure. This finding recognizes that, while people are an organization's greatest asset, they are also its weakest link, particularly in hard economic times when job insecurity and increased stress levels may lead employees to behave in atypical ways.

While both internal and external security breaches at financial institutions worldwide have fallen over the past 12 months, employee misconduct is a growing concern for these organizations. More than a third (36 percent) of respondents expressed concern about insiders' misconduct, compared to only 13 percent who are concerned about external threats. Furthermore, six in 10 (58 percent) of survey participants are concerned about their ability to protect their organization from internal cyber-attacks.

Additional survey findings include:

• Phishing and pharming continue to be cited by respondents as causing one of the highest levels of concern, although the current techniques continue to evolve. This also ranks as the leading type of external breach experienced by respondents (22 percent).
• The growing popularity of social networks and the proliferation of mobile media such as USB keys, MP3 players and PDAs are causing an extra load on internal and external security. Interestingly, more than half of financial institutions surveyed now restrict the use of social networks and instant messaging (53 percent and 58 percent, respectively).
• Respondents' top three information security priorities are: security regulatory compliance and, tied in second place, access and identity management and data protection and information leakage.
• The leading drivers for respondents to protect the privacy of their clients are regulatory privacy requirements (79 percent) followed by reputation and brand concerns (70 percent).

The Deloitte Touche Tohmatsu survey is based on interviews with senior security officers from the world's top global financial institutions. The respondents represented public and private organizations from 32 countries.