‘Eighty per cent of the cases probably has its origin within the organisation. (By) someone who knows the system, the process, and who would intentionally, maliciously gain access,’ stated Dr Gurpreet Dhillon, Professor at the Virginia Commonwealth University, US.

‘It is always the trusted person within the organisation who has access to the system. Cases of errors do occur, but people who know the system would obviously exploit the system,’ he told Khaleej Times.

Speaking on the sidelines of the cyber security workshop in the Capital on Wednesday, Dhillon underscored the importance keeping the integrity of the organisation intact by hiring the right, trustworthy individuals.

‘Technically we can do a few things of course, but unfortunately we over rely on technologies to protect ourselves; safeguards, passwords, we over rely on them. I think equally important is making people responsible.’

He added that in managing security, emphasis should be given to human solutions ‘in ensuring that the right kind of people have place in the organisation.’

Regional challenge

Cyber security is a key challenge, yet companies in the Middle East region are more vulnerable compared to the rest of the world.

‘The few studies we have indicate that companies in the region are more vulnerable, at least 50 per cent more vulnerable than other regions of the world. And that is largely because of the evolving technological infrastructure (here),’ said Dhillon. The problem, according to Dhillon, is the ‘imported system and technologies’ that were designed for a different environment.

‘Usually what happens is we import or just simply put in place this technical edifice hoping that it will work because it works somewhere else. It has to be customised to the rules and procedures that we have in place, and vice versa. We just can’t simply import a 
solution from (another) country... and say it’s going to work here.’

The practice of importing manpower to build the ‘technical edifice’ and manage the system could also potentially pose a problem for companies here.

According to a global survey by PricewaterhouseCoopers this year on information security, only 20 per cent of companies in the Middle East have an information security strategy for either cloud computing, mobile devices or social media. In addition, over a quarter of respondents do not know what data privacy safeguards their organisation had in place.

olivia@khaleejtimes.com