One in five employees alter IT security settings

By: Howard Solomon - Network World Canada (30 Sep 2008)

Data leakage isn’t just a networking issue, says survey sponsor Cisco Systems. The study of people in 10 countries found employees persist in engaging in risky behaviour

Flying can be more than a means of getting from A to B. It can also be educational if your seat-mate is careless while working on a laptop.

Patrick Gray, senior security strategist at Cisco Systems, for example, recalls what could have been an educational trip this month on a trip across the U.S. “I was on an airplane flying out to Salt Lake City (Utah) last week sitting next to a consultant with one of the final four consultancies doing a write-up on a Fortune 10 company,” he recalled in an interview. “Gee, it was great stuff we could probably use at Cisco if I were a nefarious kind of a guy.”

The former FBI and National Security Agency staffer has no doubt what he could read was sensitive – it had “Confidential” written all over it.

For years untold trees have died to carry warnings about the need to ensure corporate data is protected. Yet even today the message isn’t getting through, judging by the regular news reports about PCs stolen from offices and cars with gigabytes of unsecured personal information and online break-ins of databases.

To get an idea of why data is still being lost Cisco released a survey Tuesday it paid for earlier this year which questioned 1,000 employees and 1,000 IT professionals in 10 countries – the U.S, Britain, France, Germany, Italy, Japan, China, Brazil, India and Australia – to find out why and see if there are cultural differences in how people practice security.

Some of the results may not be surprising. For example, almost two of three employees admitted using work computers daily for personal use, such as downloads, shopping and e-mail.

But consider these findings:

-one in five employees said they altered security settings on work devices to bypass IT policy so they could access unauthorized Web sites;

-seven of 10 IT professionals said employee access of unauthorized Web sites and applications (including online shopping sites) ultimately resulted in as many as half of their companies’ data loss incidents;

-in the past year, two of five IT professionals came across staffers accessing unauthorized parts of a network or facility. Two-thirds had to deal with this danger more than once in the past year. Fourteen per cent said it happens monthly;

-24 per cent of employees said they have verbally shared sensitive information to non-employees, including strangers;