Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

1/13/2009
02:57 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Absolute And Ponemon Institute Study Shows Many Employees Undermine Data Prevention

Study finds 56% of U.S. business managers disable laptop encryption, increasing risk of data and identity theft

Vancouver, Canada and Traverse City, Michigan: January 13, 2009 " Absolute Software Corporation and the Ponemon Institute today announced the findings of a new study on the use of encryption on laptops by employees within corporations in the U.S. The study, "The Human Factor in Laptop Encryption: US Study," revealed that more than half (56%) of business (non-IT) managers polled, disable the encryption solution on their laptops. Ninety-two percent of IT security practitioners report that someone in their organization has had a laptop lost or stolen and 71% report that it resulted in a data breach. Results indicate that it is employee behavior that undermines data protection efforts in corporate America. Companion studies of UK and Canadian companies are also available.

"The data suggests that, because of user behavior, encryption alone is not enough to protect mobile devices and the sensitive data stored on them," said Dr. Larry Ponemon, chairman and founder of The Ponemon Institute. "These statistics are especially disconcerting when combined with our recent studies demonstrating that lost or stolen laptops are the number one cause of data loss, with 3 out of 4 companies experiencing a data breach when a laptop has been lost or stolen."

The report shows that many business managers fail to take necessary precautions to secure their laptops, such as using additional security solutions, and instead are overly dependent on their encryption solutions to protect the sensitive data on their laptops.

"The Human Factor in Laptop Encryption: U.S. Study" key findings include:

* 92% of IT security practitioners report that someone in their organization has had a laptop lost or stolen and 71% report that it resulted in a data breach; * 56% of business managers have disengaged their laptop's encryption; * Only 45% of IT security practitioners report that their organization was able to prove the contents of missing laptops were encrypted; * Only 52% of business managers " employees most likely to have access to the most sensitive data (personally identifiable information and/or intellectual property) " have employer-provided encryption; * 57% of business managers either keep a written record of their encryption password, or share it with others in case they forget it; * 61% of business managers share their passwords, compared to only 4% of IT managers; and, * Business managers are much more likely than IT security practitioners to believe encryption makes it unnecessary to use other security measures for laptop protection.

In the event of a theft, companies relying solely on encryption cannot be sure whether all stored data on a laptop has been encrypted, if it has been compromised, or even which files have been accessed by thieves. This can leave corporations with gaping holes in their security efforts, and risk exposing the company, employees, customers and consumers to data and identity theft. To help solve security risks that encryption alone cannot adequately address, companies can employ a security solution that can locate a stolen or lost laptop, detect which data has been accessed, and remotely delete sensitive data.

"This research highlights what Absolute has long-emphasized: while encryption technology provides a high-degree of data protection, it must be complemented by additional security layers that are not dependent on the diligent behavior of corporate employees," John Livingston, chairman and CEO of Absolute Software said. "If I were tasked with data security, I would read this study in detail and immediately assess my company's data protection strategy, especially if I was reliant solely on encryption. Corporations may incorrectly assume that since it is company policy to encrypt mobile data, they are not at risk for a data breach. With more than half of business managers disabling their encryption solutions, companies are left incredibly vulnerable to theft and data loss if they do not utilize additional layers of security, such as those offered by Absolute." Highlights and the complete reports for "The Human Factor in Laptop Encryption" studies for the U.S., U.K. and Canada can be found at: www.absolute.com/humanfactor.

For more information on Absolute Software and its range of computer theft recovery, data protection and IT asset management solutions, please visit: www.absolute.com or www.lojackforlaptops.com.

For a complete list of firmware-supported computers visit www.absolute.com/firmware

About the Ponemon Institute The Ponemon Institute is dedicated to advancing responsible information and privacy management practices in business and government. To achieve this objective, the Institute conducts independent research, educates leaders from the private and public sectors and verifies the privacy and data protection practices of organizations in a variety of industries.

About Absolute Software Absolute Software Corporation (TSX: ABT) is the leader in computer theft recovery, data protection and Secure Asset Tracking solutions. Absolute Software provides organizations and consumers with solutions in the areas of regulatory compliance, data protection and theft recovery. The Company's Computrace software is embedded in the firmware of computers by global leaders, including Dell, Fujitsu, General Dynamics Itronix, HP, Lenovo, Motion, Panasonic and Toshiba, and the Company has reselling partnerships with these OEMs and others, including Apple. For more information about Absolute Software and Computrace, visit www.absolute.com and http://blog.absolute.com.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-26030
PUBLISHED: 2021-04-14
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page
CVE-2021-26031
PUBLISHED: 2021-04-14
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate filters on module layout settings could lead to an LFI.
CVE-2021-27710
PUBLISHED: 2021-04-14
Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system funct...
CVE-2021-28484
PUBLISHED: 2021-04-14
An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler did not validate the length of the request, which can lead to a state where yubihsm-connector becomes stuck in a loop waiting for the YubiHSM to send i...
CVE-2021-29654
PUBLISHED: 2021-04-14
AjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database feature of the administration panel), leading to Remote Code execution.