Story image

Study: Even the Australian C-Suite flouts cybersecurity policies

04 Sep 2017

Employees in some of Australia’s largest organisations are flouting cybersecurity policies and many are sending confidential documents through unsecured devices or personal email accounts – and it’s not just junior employees who are guilty.

A study from document PDF firm Nitro says that there is now a major disconnect between employees and policies that IT managers put in place.

91% of Australian businesses with more than 500 employees mandate what devices workers can use, while 88% mandate the software.

However, 52% of employees, including managers and C-Suite executives, use personal devices for work, 38% send work-related documents through personal email and 10% save their communication or files on devices without password protection.

55% of managers, senior managers and C-Suite admit they work on personal devices, 40% send work emails and files through personal email and 10% save their communication or files on devices without password protection.

The research also pegs employee mistakes such as opening phishing emails and ransomware as the most likely security threat (40%), compared to just a 24% likelihood of hackers or fraudsters.

“In a world where data breaches are increasingly commonplace, there remains a disconnect between the security policies at Australia’s largest enterprises and the real-world behaviours of employees. Security remains a top priority for CIOs and IT managers, but it requires a company-wide compliance culture to ensure procedures are followed,” comments Nitro APAC director Adam Nowiski.

Employees may resort to using personal devices because they don’t have the right software installed on their work devices, according to 23% of respondents. 27% install unsanctioned software themselves.

“Our study revealed software standardisation is too often an overlooked tool in the CIOs kit bag for plugging potential data leaks and driving top-down culture change to an environment free of disparate solutions, inefficient processes and risky employee workarounds,” he adds.

The lack of standardisation in Australian enterprises means there are more productivity bottlenecks and potential risks. 29% of respondents send files to colleagues to action because they don’t have the right software.

“A ‘shadow IT’ environment of mismatched software and inconsistent product lifecycles makes it nearly impossible for IT managers to protect against security vulnerabilities,” Nowiski adds.

“Standardised environments allow IT managers to focus on protecting and optimising organisations’ IT systems based on uniform versions of solutions.”

The research also found that 86% of enterprises enforce strong password procedures such as complexity, rotation or two factor authentication.

One in ten respondents admit they have printed sensitive work documents without destroying the documents after use.

Avi Networks: Using visibility to build trust
Visibility, also referred to as observability, is a core tenet of modern application architectures for basic operation, not just for security.
Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Myth-busting assumptions about identity governance - SailPoint
The identity governance space has evolved and matured over the past 10 years, changing with the world around it.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.