Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3/15/2010
08:23 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Industry Poll Shocker: Employees Bypass IT Policies

A poll released today by Harris Interactive found that a good portion of workers admit that they knowingly violate IT policies so that they can get their work done. My take: those workers that didn't admit that they violate corporate compliance and security policies are liars.

A poll released today by Harris Interactive found that a good portion of workers admit that they knowingly violate IT policies so that they can get their work done. My take: those workers that didn't admit that they violate corporate compliance and security policies are liars.According to the poll of 1,347 employed adults ages 18 and up showed that 12 percent admitted to breaking policy. The poll was conducted online by Harris Interactive between February 2 and 4, and funded by mobility service provider Fiberlink.

Here's the quote from CEO of Fiberlink, from the company's statement announcing the poll:

"We see this as a mobility wake-up call for all IT managers," said Jim Sheward, CEO of Fiberlink. "IT departments nationwide spend a lot of time and money on their compliance, usage, and access policies, but they only work if people follow the rules. Without extensive and effective compliance tools that ensure that IT policies are being followed, companies could face dangerous breaches that include the loss of sensitive data, competitive intelligence, or customers' private information."

First, these poll results could apply to just about any IT security and policy compliance issue: passwords, encryption, rogue wireless access points, shutting down anti-malware when it becomes inconvenience, and the list goes on. But Fiberlink sells mobility management services, so that's their spin. Too bad the poll (or at least it wasn't communicated in the release) didn't focus on actual mobile compliance issues.

Second, enterprises need to spend on the controls that make the most sense for their tolerance to risk and need to mitigate that risk.

Third, Sheward was too tame in one of his remarks: enterprises that rely too heavily on their employees to make the right decisions when it comes to security and compliance will lose sensitive data, intelligence, customers' private information, or suffer some significant incident. It's really just a matter of time.

I think the 88 percent of respondents who said they don't bypass policies to get work down are either lying outright, or are fooling themselves. Who hasn't broken a corporate policy to expedite workflow?

Such things could include using a simpler password that is more easily remembered, or even writing down a complex password on paper. It could include copying unencrypted data to a USB drive, using home PCs to work on company files, using wireless connections with their corporate issued notebook. Users who click on links or open attachments from people they don't know, or access certain Web sites are probably violating policy. And the list could go on indefinitely. While few break all of the rules all of the time, fewer still follow all of the rules all of the time.

That's why companies that rely on end users to do the right thing and always follow security policy are heading for trouble. A certain percentage of users, no matter how small it is, will click on links they shouldn't, they'll visit Web sites they shouldn't, they'll use passwords they know are inadequate, and they'll check e-mail from the corner coffee shop wireless connection.

All of those actions jeopardize not only the end user doing them, but the security and compliance posture of the entire organization. And enterprises that don't use technological controls to thwart these behaviors are just asking for trouble.

For my security and technology observations throughout the day, follow me on Twitter.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27852
PUBLISHED: 2021-01-20
A stored Cross-Site Scripting (XSS) vulnerability in the survey feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via a textarea field. This code is interpreted by users in a privileged role (Administrator, Editor, etc.).
CVE-2021-3137
PUBLISHED: 2021-01-20
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.
CVE-2020-27850
PUBLISHED: 2021-01-20
A stored Cross-Site Scripting (XSS) vulnerability in forms import feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via the import of a GF form. This code is interpreted by users in a privileged role (Administrator, Editor, etc.).
CVE-2020-27851
PUBLISHED: 2021-01-20
Multiple stored HTML injection vulnerabilities in the "poll" and "quiz" features in an additional paid add-on of Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary HTML code via poll or quiz answers. This code is interpreted by users in a privile...
CVE-2020-13134
PUBLISHED: 2021-01-20
Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself), and can exploit (be triggered by) admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1...