The Security Risk in the Cubicle Next Door

[Audrey McNeil <audrey () riskbasedsecurity com>]

http://www.strategy-business.com/blog/The-Security-Risk-in-the-Cubicle-Next-Door?gko=6854e

As laptops, smartphones, and Wi-Fi become more prevalent in the business
world, so do the risks that corporate and customer data can be lost or
stolen. Analysts predict the information security sector will grow into a
US$125 billion industry by 2015. But no amount of data encryption or
firewalls can guarantee that employees won’t misbehave. A new study says
the human element is the most vital line of defense against cybercrime.

First, companies must overcome the significant difference of opinion
between IT experts and the managers who make the routine decisions about
their firm’s information security. One of the starkest differences revolves
around the danger posed by a firm’s own employees.

The authors conducted in-depth interviews with frontline workers, managers,
and information security professionals—CIOs and network administrators—at
large firms in a variety of industries across the United States. Points of
contention quickly emerged. For example, 39 percent of managers cited
hackers as the biggest danger, whereas only 4 percent of security
specialists agreed, citing threats such as Trojans, viruses, or worms as
more dangerous. But in reality, a company’s own staff can be even more
vexing: Almost 60 percent of security professionals pinpointed employees as
the most likely source of accidental or intentional breaches.

The most essential bulwark against cybercrime appears to be a happy
workforce , according to the study. The interviews revealed two factors
that led employees to consciously betray their firms: the knowledge that
the proprietary information in a database could be sold to competitors, or
a desire to exact revenge on the company for some kind of perceived slight.

Draconian practices seeking to limit employees’ Internet access can often
backfire if they sow bitterness. Instead, managers at all levels should
appeal to their employees’ sense of obligation to protect their
organization’s resources—emphasizing that other people may be harmed by
their mistake. Accordingly, the authors advise, IT professionals should
focus on the idea of protecting “others” rather than “the company.”



And IT experts can dampen some of their employees’ interest in financial
gain by emphasizing how coworkers, customers, and employees’ own families
could be devastated by a security breach, with consequences ranging from
identity theft to widespread job loss.

Whether employees stay on their toes can also depend on their leaders’
attitudes. When the managers responsible for security training project an
air that all is well, employees can be lulled into believing that they no
longer need to be vigilant. Most important, the authors write, IT
professionals should communicate the “clear message that security is
everybody’s job.”

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
YourCISO is an affordable SaaS solution that provides a comprehensive information security program that ensures focus 
on the right security.  If you need security help or want to provide real risk reduction for your clients contact us!