Employees have lax attitudes to corporate confidentiality and data protection, which challenges the assumption that IT alone can eliminate security risks, according to new research.
A survey of more than 1,000 employees and 1,000 IT professionals in 10 countries including the UK found behavioural mistakes were common, creating data security risks and criminal opportunities.
The most common habit that could weaken IT security defences was altering security settings on computers. One in five admitted to altering security settings on work devices to bypass IT policy so they could access unauthorised websites.
A further seven out of ten IT professionals said employee access unauthorised applications and websites, like online shops or social networks, had ultimately resulted in as many as half of their companies' data loss incidents. And half of the employees questioned used personal email to reach customers and colleagues, but only 40 per cent said this was authorised by IT.
Other common risky habits were associated with the physical security of IT systems, leaving them or their system logins and passwords unsecured: one in five employees stored passwords on their computer or wrote them down and left them pasted on their computers. This was most frequent among Chinese workers (28 per cent), but also with 10 per cent of UK staff questioned.
And the seeming disregard for corporate security procedures was most starkly demonstrated by the fact that one of four employees (24 per cent) admitted verbally sharing sensitive information to non-employees, such as friends, family, or even strangers.
The other noteworthy gaffes illustrate how the influence of mobile devices and the blurring of their use for work and personal use. Almost one in four employees had carried corporate data on portable storage devices outside of the office. And some 44 per cent had shared work devices with other outside work without supervision, while two of three employees admitted using IT devices daily for personal use.
John Stewart, chief security officer of survey sponsor, Cisco said understanding how employee behaviour affects the risks of data loss can help create more effective, localised training and security policies.
"Data protection requires teamwork across the company. It's not just an IT job anymore," he said.
The research conducted by US market researcher, Insight Express surveyed respondents from the UK, US, France, Germany, Italy, Japan, China, India, Australia, and Brazil.
