The enemy within
Geeks, squatters and saboteurs threaten corporate security
By John Leyden
Published Thursday 15th December 2005 12:06 GMT
Workers across Europe are continuing to place their own companies at
risk from information security attacks. This 'threat from within' is
undermining the investments organisations make to defend against
security threats, according to a study by security firm McAfee.
The survey, conducted by ICM Research, produced evidence of both
ignorance and negligence over the use of company IT resources. One in
five workers (21 per cent) let family and friends use company laptops
and PCs to access the internet, dramatically increasing the chances
of infection of the device and potentially the corporate network.
This behaviour also exposes work documents to prying eyes as well as
increased malware infestation risks through use of a potentially
unprotected home network connection.
Naturally McAfee has a vested interest in talking up this kind of
threat but its findings on how workers use company laptops are
nonetheless worthy of note.
More than half (51 per cent) connect their own devices or gadgets to
their work PC and a quarter of these do so every day. Around 60 per
cent admit to storing personal content on their work PC. One in ten
confessed to downloading content at work they shouldn’t. Spanish
workers were the worst offenders at this with just under one in five
(18 per cent) admitting to downloading inappropriate content,
behaviour that leaves firms at heightened risk to both security
attacks and legal sanctions.
Two thirds (62 per cent) of those quizzed admitted they have a very
limited knowledge of IT Security. More than half (51 per cent) of
those polled had no idea how to update the anti-virus protection on
their company PC.
Most errant workers put their firm at risk through either complacency
or ignorance but a small minority are believed to be actively seeking
to damage the company from within. Five per cent of those questioned
say they have accessed areas of their IT system they shouldn’t have
(including access to HR and accounting files) while a very small
number admitted to stealing information from company servers.
Based on its survey, McAfee has identified four types of employees
who put their workplace at risk:
The Security Softie – This group comprises the vast majority of
employees. They have a very limited knowledge of security and put
their business at risk through using their work computer at home or
letting family members surf the internet on their work PC.
The Gadget Geek – Those that come to work armed with a variety of
devices/gadgets, all of which get plugged into their PC.
The Squatter – Those who use the company IT resources in ways they
shouldn’t (i.e. by storing content or playing games).
The Saboteur – A very small minority of employees. This group will
maliciously hack into areas of the IT system to which they shouldn’t
have access or infect the network purposely from within
McAfee said businesses need to step up efforts to educate their
employees about safe use of company IT resources while at the same
time rolling out technology to ensure that non-compliant devices
cannot access the network. Happily McAfee Policy Enforcer, scheduled
for release next year, is designed with just this purpose in mind.
Other security firms including Cisco and Checkpoint Software have
already released network access control software, which is set to be
a major focus of development for IT security vendors next year.
search: