Story image

Study: Even the Australian C-Suite flouts cybersecurity policies

04 Sep 17

Employees in some of Australia’s largest organisations are flouting cybersecurity policies and many are sending confidential documents through unsecured devices or personal email accounts – and it’s not just junior employees who are guilty.

A study from document PDF firm Nitro says that there is now a major disconnect between employees and policies that IT managers put in place.

91% of Australian businesses with more than 500 employees mandate what devices workers can use, while 88% mandate the software.

However, 52% of employees, including managers and C-Suite executives, use personal devices for work, 38% send work-related documents through personal email and 10% save their communication or files on devices without password protection.

55% of managers, senior managers and C-Suite admit they work on personal devices, 40% send work emails and files through personal email and 10% save their communication or files on devices without password protection.

The research also pegs employee mistakes such as opening phishing emails and ransomware as the most likely security threat (40%), compared to just a 24% likelihood of hackers or fraudsters.

“In a world where data breaches are increasingly commonplace, there remains a disconnect between the security policies at Australia’s largest enterprises and the real-world behaviours of employees. Security remains a top priority for CIOs and IT managers, but it requires a company-wide compliance culture to ensure procedures are followed,” comments Nitro APAC director Adam Nowiski.

Employees may resort to using personal devices because they don’t have the right software installed on their work devices, according to 23% of respondents. 27% install unsanctioned software themselves.

“Our study revealed software standardisation is too often an overlooked tool in the CIOs kit bag for plugging potential data leaks and driving top-down culture change to an environment free of disparate solutions, inefficient processes and risky employee workarounds,” he adds.

The lack of standardisation in Australian enterprises means there are more productivity bottlenecks and potential risks. 29% of respondents send files to colleagues to action because they don’t have the right software.

“A ‘shadow IT’ environment of mismatched software and inconsistent product lifecycles makes it nearly impossible for IT managers to protect against security vulnerabilities,” Nowiski adds.

“Standardised environments allow IT managers to focus on protecting and optimising organisations’ IT systems based on uniform versions of solutions.”

The research also found that 86% of enterprises enforce strong password procedures such as complexity, rotation or two factor authentication.

One in ten respondents admit they have printed sensitive work documents without destroying the documents after use.

Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Security platform provider Deep Instinct expands local presence
The company has made two A/NZ specific leadership hires and formed several partnerships with organisations in the region.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.
Stepping up to sell security services in A/NZ
WatchGuard Technologies A/NZ regional director gives his top tips on how to make a move into the increasingly lucrative cybersecurity services market.
Huawei founder publically denies spying allegations
“After all the evidence is made public, we will rely on the justice system.”
Malware downloader on the rise in Check Point’s latest Threat Index
Organisations continue to be targeted by cryptominers, despite an overall drop in value across all cryptocurrencies in 2018.
IoT breaches: Nearly half of businesses still can’t detect them
The Internet of Thing’s (IoT’s) rapid rise to prominence may have compromised its security, if a new report from Gemalto is anything to go by.