Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


08:23 PM
George V. Hulme
George V. Hulme

Industry Poll Shocker: Employees Bypass IT Policies

A poll released today by Harris Interactive found that a good portion of workers admit that they knowingly violate IT policies so that they can get their work done. My take: those workers that didn't admit that they violate corporate compliance and security policies are liars.

A poll released today by Harris Interactive found that a good portion of workers admit that they knowingly violate IT policies so that they can get their work done. My take: those workers that didn't admit that they violate corporate compliance and security policies are liars.According to the poll of 1,347 employed adults ages 18 and up showed that 12 percent admitted to breaking policy. The poll was conducted online by Harris Interactive between February 2 and 4, and funded by mobility service provider Fiberlink.

Here's the quote from CEO of Fiberlink, from the company's statement announcing the poll:

"We see this as a mobility wake-up call for all IT managers," said Jim Sheward, CEO of Fiberlink. "IT departments nationwide spend a lot of time and money on their compliance, usage, and access policies, but they only work if people follow the rules. Without extensive and effective compliance tools that ensure that IT policies are being followed, companies could face dangerous breaches that include the loss of sensitive data, competitive intelligence, or customers' private information."

First, these poll results could apply to just about any IT security and policy compliance issue: passwords, encryption, rogue wireless access points, shutting down anti-malware when it becomes inconvenience, and the list goes on. But Fiberlink sells mobility management services, so that's their spin. Too bad the poll (or at least it wasn't communicated in the release) didn't focus on actual mobile compliance issues.

Second, enterprises need to spend on the controls that make the most sense for their tolerance to risk and need to mitigate that risk.

Third, Sheward was too tame in one of his remarks: enterprises that rely too heavily on their employees to make the right decisions when it comes to security and compliance will lose sensitive data, intelligence, customers' private information, or suffer some significant incident. It's really just a matter of time.

I think the 88 percent of respondents who said they don't bypass policies to get work down are either lying outright, or are fooling themselves. Who hasn't broken a corporate policy to expedite workflow?

Such things could include using a simpler password that is more easily remembered, or even writing down a complex password on paper. It could include copying unencrypted data to a USB drive, using home PCs to work on company files, using wireless connections with their corporate issued notebook. Users who click on links or open attachments from people they don't know, or access certain Web sites are probably violating policy. And the list could go on indefinitely. While few break all of the rules all of the time, fewer still follow all of the rules all of the time.

That's why companies that rely on end users to do the right thing and always follow security policy are heading for trouble. A certain percentage of users, no matter how small it is, will click on links they shouldn't, they'll visit Web sites they shouldn't, they'll use passwords they know are inadequate, and they'll check e-mail from the corner coffee shop wireless connection.

All of those actions jeopardize not only the end user doing them, but the security and compliance posture of the entire organization. And enterprises that don't use technological controls to thwart these behaviors are just asking for trouble.

For my security and technology observations throughout the day, follow me on Twitter.


Recommended Reading:

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
'BootHole' Vulnerability Exposes Secure Boot Devices to Attack
Kelly Sheridan, Staff Editor, Dark Reading,  7/29/2020
Average Cost of a Data Breach: $3.86 Million
Jai Vijayan, Contributing Writer,  7/29/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-08-04
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the ship...
PUBLISHED: 2020-08-04
Extreme Analytics in Extreme Management Center before allows unauthenticated reflected XSS via a parameter in a GET request, aka CFD-4887.
PUBLISHED: 2020-08-04
save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF...
PUBLISHED: 2020-08-04
An exploitable arbitrary file delete vulnerability exists in SoftPerfect RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can allow an unprivileged user to delete any file on the filesystem. An attacker can send a malicious IRP to trigger this vulnerability.
PUBLISHED: 2020-08-04
An issue was discovered in the Gantt-Chart module before 5.5.4 for Jira. Due to a missing privilege check, it is possible to read and write to the module configuration of other users. This can also be used to deliver an XSS payload to other users' dashboards. To exploit this vulnerability, an attack...