In a white paper released last November by RSA, research from ordinary person-on-the street interviews with random office workers revealed troubling trends for those concerned with information security. Sometimes in an honest effort to finish their work from home or while traveling, sometimes through simple carelessness, but in either case without intending to put secure information at risk, employees from all sectors of the workplace admitted to behaviors which do, in fact, put secure information at risk.
In interviews conducted in Boston and Washington, D.C., employees from both the public and the private sector answered "frequently," "sometimes," or "never" to questions probing their own customary behavior and also to questions asking what they had observed in their workplace. Employers with international networks full of proprietary and confidential private information, including social security numbers and other personally identifying information, were reported by nearly 20% of private enterprise employees as routinely leaving networks set up for conference room and guest use open and available, without a password, to anyone who might walk in.
Employees themselves, with their own logins and passwords, accessed their work-network at home, in airports, in hotel and restaurant hot-spots, and even, at times, on public access hotel or internet cafe-type computer terminals. In fact, the number of workers who retrieved their work e-mail from a public access computer was slightly higher than the number who used their own laptop but at a public wireless hotspot. Both numbers, however, were over 50%. Since well over 80% of workers reported that they "frequently" or "sometimes" conduct business over some kind of network away from their workplace, one can conclude that perhaps 30% of employees access work from a home computer, either by modem high speed internet connection.
More knowledge of security protocols will not solve the problem, according to RSA. Almost all employees confirm that they have been trained in their employer's security policies and that they are familiar with those policies. Nevertheless, they hold doors to secure areas open for persons they don't recognize, they notice people they don't know working in empty offices without comment, and they find themselves with access to parts of the network they know they have no need to see.
Perhaps most troubling, a full third of all employees surveyed answered "yes" to the question, "Do you ever feel that you need to work around your company's established security policies and procedures just to get your job done."
RSA concluded its report, provocatively titled "The Confessions Report," with a summary of its findings and a set of "Recommendations for Managing Information Risk." The recommendations call for a "holistic, information-centric security strategy [that] takes people, processes and technology into account and has a feedback mechanism." Clearly, an alert has been sounded.
Christopher is an Information Security Consultant for Lexan Systems LLC. You are welcome to reproduce this article on Computer Security related web site, as long as you reproduce the article in full, including this resource box and link to our website.
