May 31, 2019
2 Min Read
The UK's Deep Secure has reported this week that the price an employee would accept to break loyalty with an organization may be a lot less than has been previously thought.
The research surveyed 1,500 UK office workers and was conducted in April.
Right out of the gate, more than half of respondents (59%) admitted that at some point they had taken company information from a corporate network or devices.
Now, some of that was completed personal work and is necessary. But contact details of clients (11%), confidential market information about the company or customers' companies (7%) and details of the sales pipeline (6%) were also taken by employees. It seems that if they can access the information, they can take it.
Seven percent of the total pool of workers said they had used or accessed company assets including passwords to subscription services (i.e. external databases, content subscriptions, company benefits) (9%), sensitive information relating to colleagues (7%) , company or customer credit card details (6%) and intellectual property (i.e. product specifications, product code, patents) (6%).
The report tries to look at why an employee would do this, what motivated them. Researchers found that 7% of respondents took company information because "they knew it would be of value to a third-party organization"; this rose to 12% if a worker had been with the company for three to four years.
Ah. They can get money for it. They think so, anyway.
In fact, the report finds that 15% of all UK employees would hand over corporate information for £1,000 (about $1,260). And that's for the good 3rd-party-is-interested-stuff.
Ten percent of all workers said they'd sell intellectual property, like product specifications and source code, for £250 (about $315) or less.
The employee's age is involved here. 19% of all employees in graduate-level roles averred that they were paid to source information for a third-party. Since 29% of office workers aged between 16 and 24 report that they have been approached by an outsider looking for company data, there is a correlating double digit rise in the percentage of third-party attempts to gain information from younger employees.
Exfiltrated corporate data can be placed on many different hardware devices (think USB stick), but the report says that 8% of those stealing information also reported using "cyber tools" to hide and exfiltrate company information (such as steganography or encryption). That means trying to watch for enterprise data before it goes out the door is getting harder.
Insider threats have to be part of a security posture, yet a low-visibility but connected worker should be thought of as much of a threat as anyone else to enterprise information.
— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.
Read more about:Security Now
About the Author(s)
Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek. He has written a book on the Secure Electronic Transaction Internet protocol. His latest book has the commercially obligatory title of Hack Proofing XML. He's been online since uucp "bang" addressing (where the world existed relative to !decvax), serving as editor of the Macintosh Exchange on BIX and the VARBusiness Exchange. His first Mac had 128 KB of memory, which was a big step up from his first 1130, which had 4 KB, as did his first 1401. You can e-mail him at [email protected].
You May Also Like
A screen displaying many different types of charts and graphs to show what data is being analyzed.Cybersecurity Analytics