Feeds

The enemy within

Geeks, squatters and saboteurs threaten corporate security

5 things you didn’t know about cloud backup

Workers across Europe are continuing to place their own companies at risk from information security attacks. This 'threat from within' is undermining the investments organisations make to defend against security threats, according to a study by security firm McAfee.

The survey, conducted by ICM Research, produced evidence of both ignorance and negligence over the use of company IT resources. One in five workers (21 per cent) let family and friends use company laptops and PCs to access the internet, dramatically increasing the chances of infection of the device and potentially the corporate network. This behaviour also exposes work documents to prying eyes as well as increased malware infestation risks through use of a potentially unprotected home network connection.

Naturally McAfee has a vested interest in talking up this kind of threat but its findings on how workers use company laptops are nonetheless worthy of note.

More than half (51 per cent) connect their own devices or gadgets to their work PC and a quarter of these do so every day. Around 60 per cent admit to storing personal content on their work PC. One in ten confessed to downloading content at work they shouldn’t. Spanish workers were the worst offenders at this with just under one in five (18 per cent) admitting to downloading inappropriate content, behaviour that leaves firms at heightened risk to both security attacks and legal sanctions.

Two thirds (62 per cent) of those quizzed admitted they have a very limited knowledge of IT Security. More than half (51 per cent) of those polled had no idea how to update the anti-virus protection on their company PC.

Most errant workers put their firm at risk through either complacency or ignorance but a small minority are believed to be actively seeking to damage the company from within. Five per cent of those questioned say they have accessed areas of their IT system they shouldn’t have (including access to HR and accounting files) while a very small number admitted to stealing information from company servers.

Based on its survey, McAfee has identified four types of employees who put their workplace at risk:

  • The Security Softie – This group comprises the vast majority of employees. They have a very limited knowledge of security and put their business at risk through using their work computer at home or letting family members surf the internet on their work PC.
  • The Gadget Geek – Those that come to work armed with a variety of devices/gadgets, all of which get plugged into their PC.
  • The Squatter – Those who use the company IT resources in ways they shouldn’t (i.e. by storing content or playing games).
  • The Saboteur – A very small minority of employees. This group will maliciously hack into areas of the IT system to which they shouldn’t have access or infect the network purposely from within

McAfee said businesses need to step up efforts to educate their employees about safe use of company IT resources while at the same time rolling out technology to ensure that non-compliant devices cannot access the network. Happily McAfee Policy Enforcer, scheduled for release next year, is designed with just this purpose in mind. Other security firms including Cisco and Checkpoint Software have already released network access control software, which is set to be a major focus of development for IT security vendors next year. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.