Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Employees Still Flouting Security Policies, Study Says

Three in 10 enterprises say their business' security is being compromised by personal use of corporate systems

Many companies believe their data is at risk because they can't stop employees from using unauthorized Web services and applications, according to a study published today.

Three out of 10 organizations report that their business' Web security has been compromised by employees' use of personal Webmail accounts, social networking sites, and online video, according to Webroot, the security software vendor that conducted the research.

More than a third of respondents estimate that employees spend more than an hour a day on non-work-related sites, according to the study. Only 15 percent of the 648 companies surveyed gave their enforcement of Internet usage policies an "A" on a conventional "report card" grading scale.

"Businesses are taking measures to protect against email-based threats, but they are not yet attuned to the greatest threat vector today: Web-based threats driven by employee Web use," says Mike Irwin, COO of Webroot. "We found that Web-borne malware increased over 500 percent in 2007, as cybercriminals developed new ways to attack on-site and remote employees through personal Web mail accounts, social networking sites and other Web 2.0 applications."

One out of four businesses reported that a Web-based threat had compromised their confidential information, threatened online transactions, or caused a Web server outage. Yet nearly 30 percent of those surveyed said they did not know whether their organization or its employees are using Web 2.0 applications.

— Tim Wilson, Site Editor, Dark Reading

  • Webroot Software Inc.

    Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win a Starbucks Card! Click Here
    Latest Comment: This comment is waiting for review by our moderators.
    Current Issue
    Navigating the Deluge of Security Data
    In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
    Flash Poll
    Rethinking Enterprise Data Defense
    Rethinking Enterprise Data Defense
    Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2019-19589
    PUBLISHED: 2019-12-05
    The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives.
    CVE-2019-19597
    PUBLISHED: 2019-12-05
    D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH HTTP header.
    CVE-2019-19598
    PUBLISHED: 2019-12-05
    D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAP_AUTH header timestamp value. In HTTP requests, part of the HNAP_AUTH header is the timestamp used to determine the time when the user sent the request. If this value is equal to t...
    CVE-2019-19596
    PUBLISHED: 2019-12-05
    GitBook through 2.6.9 allows XSS via a local .md file.
    CVE-2019-19590
    PUBLISHED: 2019-12-05
    In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at libr/asm/asm.c. This integer overflow will result in a Use-After-Free for the buffer tokens, which can be filled with arbitrary malicious data after the free. This allows remote at...