Targeted Attacks in the Workplace: Awareness & Reality (#2)
～Survey for system admins and corporate employees across the nation～
45.3% of employees are aware that their workplace can be subjected to
targeted attacks; 75.0% of system admins desire tighter security
～58.4% of system admins alarmed against leak of customer information
but less than 30% are aware of other types of data leak～

TOKYO, Japan (January 18, 2017) – Digital Arts Inc. (headquartered in Chiyoda-ku, Tokyo, Japan; CEO: Toshio Dogu; “Digital Arts”; Code 2326), a provider of information security software, conducted a study on targeted attacks in the workplace, polling 1104 corporate employees and 332 system admins across the nation.

In recent years, the number of cyber-attacks targeting corporations are on the rise, as are incidents of secondary exploitation of sensitive data including classified information and customer data. Digital Arts conducted a survey on targeted attacks to measure the level of understanding and awareness among corporate and organization employees nationwide, and to understand the current landscape of security measures in place against targeted attacks in the workplace from system admins. The first of such study was conducted and results announced in October 2015.

Employee level of understanding and awareness on targeted attacks

Survey Response by Employees

• With “targeted attacks”, people think: Virus infects computers and PCs are remotely manipulated (51.4%); Receive suspicious emails with attachments (48.9%); Corporate website manipulated by external sources (43.2%).
• Awareness that your workplace can be subjected to a targeted attack: Yes, I am aware (45.3%); Not sure (30.7%); No, I am not aware (24.0%).
• Things you do regularly to protect yourself: Do not open attachments sent by unknown sender (70.0%); Do not access suspicious web sites (43.0%); Do not install unauthorized software (41.0%).
• Device used to communicate business emails: Desktop PC provided by company (46.1%); Laptop PC provided by company (37.9%); Personal smartphone (13.6%).
• In terms of security policies in the workplace, 60.7% said “yes, we have security policies”, 31.3% said “no, we do not have policies”, and 8.0% said “cannot answer”. Furthermore, 58.1% “has not received any training on cyber security”, where 29.6% “have received training by a specialized department within the same company” and 5.8% “received training by an external specialized institution or staff”.
• With the current tide of cyber security incidents becoming a social problem, cyber security measures in the workplace has: Not changed (38.9%), Tightened slightly (30.7%), Tightened to a large extent (29.8%), Tightened considerably (60.5%).

Awareness and security measures taken by system admins against targeted attacks

• Awareness that your workplace can be an object of a targeted attack: Yes, I am aware (69.9%); No, I am not aware (19.0%); Not sure (11.1%).
• Most critical damage to your workplace after a security breach: Loss of customer data (58.4%); Loss of HR/personnel data (28.9%); Loss of IP/technical intelligence (26.8%).
• Critical next steps after security breach: Make apologies to customers (54.2%); Develop preventive measures/Evaluate the losses (49.1%); Compensate/indemnify customers for losses (40.1%).
• Current security measures in place: Anti-virus software (75.9%); Firewall (65.4%); Email filtering (47.6%)
  Security measures going forward: Would like to further tighten (75.0%); Maintain status quo (24.4%)
  Security measures to consider: Anti-virus software (55.8%); firewall (53.0%); Educate employee on cyber security/ Web filtering (38.2%).
• What you are doing to educate/send information to employees: Reminders/send information by email (59.3%); Seminar/workshops instructed by an internal specialized team (43.7%); Seminar/workshops instructed by an external specialized firm (29.2%).