In a way to understand the challenges facing businesses in protecting its sensitive information, Cisco conducted a study with employees and IT Professionals around the world. As part of the study, surveys were conducted in 10 different countries that Cisco selected because of the differences in their social and business cultures. In each country, 100 end users and 100 IT professionals were surveyed, producing a total of 2000 respondents. The research discovered that despite the security policies, procedures, and tools currently in place, employees around the world are engaging in risky behaviors that put corporate and personal data at risk. Employee behaviors included:
1- Unauthorized Application Use:
The Use of unauthorized applications on business networks can place sensitive corporate data and employees' personal information at risk. Personal email is considered as one of the most commonly used unauthorized application, followed by online banking, online bill paying, online shopping, and instant messaging. These applications pose a high risk for data loss by an employee or data theft by a hacker because they are often unmonitored and do not use corporate security standards. Employees using these applications also risk infection from malicious sites.
• 78 percent of employees accessed personal email from business computers. This number is approximately double the level of authorized use.
• 63 percent of employees admit to using a work computer for personal use every day, and 83 percent admit to using a work computer for personal use at least sometimes.
• 70 percent of IT professionals believe the use of unauthorized programs resulted in as many as half of their companies' data loss incidents. This belief was most common in the United States (74 percent), Brazil (75 percent), and India (79 percent).
2- Misuse of Corporate Computers:
Many employees knowingly use corporate computers in ways that disobey IT security policies. Examples of such acts include altering the company's security settings and sharing work devices and sensitive information with non-employees. Employees bypassed IT settings to download music, shop online, pay bills, and in some cases, engage in online gambling and pornography. Approximately one fourth of the employees surveyed admitted sharing sensitive information with friends, family, or even strangers, and almost half of the employees surveyed share work devices with people outside the company without supervision. These behaviors can result in intellectual property leaking out of the company and reaching audiences that pose serious threats to corporate security and profitability.
In many cases, it happens that many employees will start to share the use of company devices without the supervision of anybody. As an example, letting other employees work on other PC that an Accountant is using is one of the way that may lead to data leakage especially in the existence of shared files. Preventing anyone to do so will help in minimizing this issue.
Studies categorized misuse of corporate acts as follows:
• Bypass corporate policy and IT security settings
– China: 42 percent
– Brazil: 26 percent
– India: 20 percent
• Share sensitive corporate information outside the company
– Brazil: 47 percent
– India: 27 percent
– The United Kingdom: 26 percent
– Italy: 22 percent
– Germany: 24 percent
• Share work devices with non-employees without supervision
– China: 43 percent
– India: 28 percent
– Overall: 44 percent (32 percent of respondents shared work devices with co-workers, and 19 percent shared work devices with non-employee family and friends)
The following figure shows the frequency with which corporate computers are used for personal use.
3- Unauthorized Physical and Network Access:Nobody can guaranty the blockage of all the organization’s endpoints or gateways especially in the big ones. Add to that, the access of employees to unauthorized parts of the organization’s network where an administration employee accessing the financial department network is an example. Add to that, we can consider the unsecured wireless networks as one of the way that hackers can enter the network and steal organizations’ data
Many workers let unknown individuals enter corporate facilities in a behavior known as "tailgating," or give non-employees the freedom to move around corporate facilities without supervision. These actions give unauthorized individuals the chance to physically steal corporate resources or access sensitive information. Employees are sometimes guilty of accessing unauthorized parts of a corporate network or facility as well.
The following figure shows the number of times IT have had to deal with an employee for accessing unauthorized networks or facilities:
• 39 percent of IT professionals said they have dealt with an employee accessing unauthorized parts of a company's network or facility, with almost half of IT professionals reporting this in Brazil (49 percent) and the United States (46 percent), and 63 percent in China. Although Japan (28 percent) and Germany (26 percent) featured the least incidents among IT professionals, every country showed at least one fourth of its IT professionals encountering these types of incidents.
• Unauthorized physical and network access was more prevalent among midsize and enterprise businesses (46 percent), but small businesses also have frequent incidents (32 percent).
• 22 percent of German employees allow non-employees to roam around offices unsupervised.
4- Remote Worker Security:
Another way of data leakage is the unsecured remote connection. It can be done by 2 ways: The first way is that employees can transfer files between work & personal computers when they are working from their homes. Another way is the hackers and network intruders that may intercept the files and steal them or have a look on them. In both the ways, the files stolen or leaked may be used for harmful purposes and may spread around many people that may benefit from it as well
As businesses are increasing & becoming bigger, mobile employees are broadening the potential risk for data loss. Behaviors such as transferring files from a work device to a home computer that is not protected or maintained to IT's standards, using personal communications that are not as safe as corporate communications, talking about sensitive company matters where others can hear the conversation, and failing to use a laptop privacy guard when working remotely in a public place all invite information theft. Employees also fail to safeguard equipment such as laptop computers and portable storage devices, which can be lost or stolen.
• 46 percent of employees admitted to transferring files between work and personal computers when working from home.
• More than 75 percent of employees do not use a privacy guard when working remotely in a public place. This number is much higher in Brazil, China, and India-countries that have the most reckless behavior.
• 68 percent of people do not think about speaking softly on the phone when they are in public places outside of the office.
• 13 percent of those who work from home admit that they cannot connect to their corporate networks, so they send business email to customers, partners, and co-workers via their personal email.
5- Misuse of Passwords and Login/Logout Procedures:
Many users in the organizations share their passwords with their colleagues or friends where this will lead to loss of information security as those colleagues can access their other colleagues’ accounts and systems. A dangerous data leakage may happen and it may include a lot of related effects.
Logging out of a computer and using a password are some of the oldest and simplest means of computer security. At least one in three employees said they leave their computers logged on and unlocked when away from their desk, such as when they go to lunch or go home for the evening. Another common practice is to leave a laptop on a desk overnight, sometimes without logging off. One in five employees store system login information and passwords on their computer or write them down and leave them on their desk, in unlocked cabinets, or pasted on their computers.
Any of these failures to observe security protocol provide dangerous opportunities for attackers. Taken together, they not only open the door to potential threats, but also invite the attacker inside. For example, an employee who leaves a system logged on, on a desk, and with a password attached is inviting an intruder to steal the computer now and sensitive data at their leisure. If the employee used that computer for personal use, that information is also now readily available to the attacker.
• 28 percent of employees in China store login and password information for personal financial accounts on their work devices.
• 18 percent of employees share passwords with co-workers, and that rate jumps to 25 percent in China, India, and Italy.
• 10 percent of employees in India, the United Kingdom, and Italy keep written notes of login information and passwords on their desk at work, leaving sensitive data accessible if the machine is stolen even if the computer is logged off.
• 5 percent of employees in the United Kingdom and France leave passwords to personal and financial accounts printed on their desks at work, so their information can be stolen with any other computer even if their work computer is safeguarded.
