Cisco Highlights Common Behavioural Security Risks

By Greg McNevin

October 1, 2008: Cisco has rolled out results from a new global study into behavioural risks and what they can mean to business security, highlighting common data leakage mistakes, but also how risk management must be tailored from country to country.

Based on surveys of more than 2,000 employees and information technology professionals in 10 countries (including, Australia, Brazil, China, France, Germany, India, Italy, Japan, United Kingdom and the United States), Cisco found that employee behavioural risks can vary by country and culture and that as employee lifestyles change, new risks are created.

Cisco says that as the reliance on centralised offices shifts to distributed business models and remote workforces, lines are blurring between work life and personal life. It says that as operations shift, work is increasing being conducted via collaborative devices and applications that are used for both purposes, including mobile phones, laptops, Web 2.0 applications, video and other social media.

“We conducted this research in order to understand behaviour, not technology per se,” said John N. Stewart, chief security officer of Cisco. “Security is ultimately rooted in users behaviour, so businesses of all sizes and employees in all professions need to understand how behaviour affects the risk and reality of data loss - and what that ultimately means for both the individual and enterprise.”

The most common mistakes Cisco found included:

• Altering security settings on computers: One of five employees altered security settings on work devices to bypass IT policy so they could access unauthorised Web sites. This was most common in emerging economies like China and India. When asked why, more than half (52 percent) said they simply wanted to access the site; a third said, "it's no one's business" which sites they access.
• Use of unauthorised applications: Seven of 10 IT professionals said employee access of unauthorised applications and Web sites (e.g. unsanctioned social media, music download software, online shopping venues) ultimately resulted in as many as half of their companies' data loss incidents. This belief was most common in countries like the United States (74 percent) and India (79 percent).
• Unauthorised network/facility access: In the past year, two of five IT pros dealt with employees accessing unauthorised parts of a network or facility. This was most prevalent in China, where almost two of three respondents encountered this issue. Of those who reported this issue globally, two-thirds encountered multiple incidents in the past year, and 14 percent encountered this issue monthly.
• Sharing sensitive corporate information: In a sign that corporate trade secrets aren't always secret, one of four employees (24 percent) admitted verbally sharing sensitive information to non-employees, such as friends, family, or even strangers. When asked why, some of the most common answers included, "I needed to bounce an idea off someone", "I needed to vent", and "I did not see anything wrong with it."
• Sharing corporate devices: In a sign that data isn't always in the hands of the right people, almost half of the employees surveyed (44 percent) share work devices with others, such as non-employees, without supervision.
• Blurring of work and personal devices, communications: Almost two of three employees admitted using work computers daily for personal use. Activities included music downloads, shopping, banking, blogging, participating in chat groups, and more. Half of the employees use personal email to reach customers and colleagues, but only 40 percent said this is authorized by IT.
• Unprotected devices: At least one in three employees leave computers logged on and unlocked when they're away from their desk. These employees also tend to leave laptops on their desks overnight, sometimes without logging off, creating potential theft incidents and access to corporate and personal data.
• Storing logins and passwords: One in five employees store system logins and passwords on their computer or write them down and leave them on their desk, in unlocked cabinets, or pasted on their computers. In some countries like China (28 percent), employees reported storing logins and passwords to personal financial accounts on their work devices, leaving their identity and finances at risk. The fact that some employees leave devices unattended magnifies this risk.
• Losing portable storage devices: Almost one in four (22 percent) employees carry corporate data on portable storage devices outside of the office. This is most prevalent in China (41 percent) and presents risks when devices are lost or stolen.
• Allowing "tailgating" and unsupervised roaming: More than one in five (22 percent) German employees allow non-employees to roam around offices unsupervised. The study average was 13 percent. And 18 percent have allowed unknown individuals to tailgate behind employees into corporate facilities.

“Businesses are enabling employees to become increasingly collaborative and mobile,” said Stewart. “Without modern-day security technologies, policies, awareness and education, information is more vulnerable.

“Today, data is in transit, in use, within programs, stored on devices, and in places beyond the traditional business environment, such as at home, on the road, in cafes, on airplanes and trains. This trend is here to stay. To protect your data effectively, we need to start understanding the risk characteristics of business and then base technology, policy, and awareness and education plans on those factors.”

To address the issues raised by its research, Cisco recommends employees treat data as “if it's your own - protect it like it's your money”, and it suggests that companies know their data and manage it well, institutionalise standards, foster a culture of trust so employees feel comfortable reporting incidents and establish security awareness, education and training.

Comment on this story