Story image

Study: Even the Australian C-Suite flouts cybersecurity policies

04 Sep 2017

Employees in some of Australia’s largest organisations are flouting cybersecurity policies and many are sending confidential documents through unsecured devices or personal email accounts – and it’s not just junior employees who are guilty.

A study from document PDF firm Nitro says that there is now a major disconnect between employees and policies that IT managers put in place.

91% of Australian businesses with more than 500 employees mandate what devices workers can use, while 88% mandate the software.

However, 52% of employees, including managers and C-Suite executives, use personal devices for work, 38% send work-related documents through personal email and 10% save their communication or files on devices without password protection.

55% of managers, senior managers and C-Suite admit they work on personal devices, 40% send work emails and files through personal email and 10% save their communication or files on devices without password protection.

The research also pegs employee mistakes such as opening phishing emails and ransomware as the most likely security threat (40%), compared to just a 24% likelihood of hackers or fraudsters.

“In a world where data breaches are increasingly commonplace, there remains a disconnect between the security policies at Australia’s largest enterprises and the real-world behaviours of employees. Security remains a top priority for CIOs and IT managers, but it requires a company-wide compliance culture to ensure procedures are followed,” comments Nitro APAC director Adam Nowiski.

Employees may resort to using personal devices because they don’t have the right software installed on their work devices, according to 23% of respondents. 27% install unsanctioned software themselves.

“Our study revealed software standardisation is too often an overlooked tool in the CIOs kit bag for plugging potential data leaks and driving top-down culture change to an environment free of disparate solutions, inefficient processes and risky employee workarounds,” he adds.

The lack of standardisation in Australian enterprises means there are more productivity bottlenecks and potential risks. 29% of respondents send files to colleagues to action because they don’t have the right software.

“A ‘shadow IT’ environment of mismatched software and inconsistent product lifecycles makes it nearly impossible for IT managers to protect against security vulnerabilities,” Nowiski adds.

“Standardised environments allow IT managers to focus on protecting and optimising organisations’ IT systems based on uniform versions of solutions.”

The research also found that 86% of enterprises enforce strong password procedures such as complexity, rotation or two factor authentication.

One in ten respondents admit they have printed sensitive work documents without destroying the documents after use.

ESET researchers break down latest arsenal of the infamous Sednit group
At the end of August 2018, the Sednit group launched a spear-phishing email campaign, in which it distributed shortened URLs that delivered first-stage Zebrocy components.
Container survey shows adoption accelerating while security concerns remain top of mind
The report features insights from over 500 IT professionals.
Google 'will do better' after G Suite passwords exposed since 2005
Fourteen years is a long time for sensitive information like usernames and passwords to be sitting ducks, unencrypted and at risk of theft and corruption.
Who's watching you? 
With privacy an increasing concern amongst the public, users should be more aware than ever of what personal data companies hold.
Fake apps on Google Play scamming users out of cryptocurrency
Fake cryptocurrency apps on Google Play have been discovered to be phishing and scamming users out of cryptocurrency, according to a new report from ESET.
Managing data to comply with privacy regulations - Micro Focus
It’s crucial for organisations to be able to access, understand, and accurately classify the data they have so they know how to treat it.
Hackbusters! Reviewing 90 days of cybersecurity incident response cases
While there are occasionally very advanced new threats, these are massively outnumbered by common-or-garden email fraud, ransomware attacks and well-worn old exploits.
SEGA turns to Palo Alto Networks for cybersecurity protection
When one of the world’s largest video game pioneers wanted to strengthen its IT defences against cyber threats, it started with firewalls and real-time threat intelligence from Palo Alto Networks.