It is a pleasant surprise to learn that employees understand the need for increased security and abide by corporate policy, said Jacques Erasmus, chief information security officer for Webroot. That said, employees at all levels still introduce risk to a corporate network through activities like surfing the web, shopping online, planning personal events and accessing personal email accounts while at work. As we see more and more malware being spread through the browser, such as Zeus and SpyEye which infects users computers to track their keystrokes and steal their banking information, it is vitally important for companies to put in place suitable web security solutions and develop effective and secure web security policies to help protect their organisation.
Surveying more than 2,500 employees in the United States, United Kingdom and Australia, Webroot also found that executive or senior management staff performed non-work related activities during work at a higher rate than their subordinates. For example, 41 percent of executives reported planning personal events such as holidays, weddings or parties while on the clock, while just 35 per cent of regular, full-time employees reported doing similar activities.
Additional Findings:
Employees feel security policies at work are very necessary:
- 95 per cent agree that compliance with their employers security policies is important;
- 83 per cent consider protection of customer information and data as a benefit;
- 89 per cent believe security policies help with the prevention of infections or viruses on the company network;
- Few employees (seven per cent) expressed extreme concern that employers monitor their online activities;
- Nearly two-thirds (61 per cent) reported that their employers security policies never or rarely make it more difficult for them to do their jobs;
- 75 per cent believe security policies are a necessary evil.
UK employers were also seen to impose more security policies than employers from the United States or Australia:
- Login password for company computers: 90 per cent in the UK vs. 84 per cent overall;
- Program download restrictions: 62 per cent vs. 55 per cent overall;
- Restrictions on accessing network outside of the office: 46 per cent vs. 37 per cent overall;
- Two-factor authentication for network or computer access: 28 per cent vs. 20 per cent overall.
Of those who skirt around corporate security policies, younger employees (those aged 18 to 29) reported a higher incidence of doing so:
- 15 per cent used a mobile device to do activities not allowed at work vs. 6 per cent overall;
- 12 per cent accessed prohibited sites from a mobile device vs. 5 per cent overall;
- 6 per cent manipulated browser settings vs. 3 percent overall.
Employees learn from their coworkers mistakes:
- 26 per cent of respondents were aware of someone who received a warning as a result of breaking security policies;
- 18 per cent were aware of someone who was fired;
- 9 per cent someone whose computer privileges were reduced;
- 8 per cent someone who was put on probation.
While all employees use company-owned devices to do non-work activities at work, executive and senior management seem to do more than other staff:
- Purchased non-work related items online: 48 per cent vs. 42 per cent overall;
- Personal event planning: 41 per cent vs. 35 per cent overall;
- Instant messenger use: 17 per cent vs. 12 per cent overall;
- Moved files using an online backup service: 12 per cent vs. 7 per cent overall.
What should organisations do?
For companies wishing to implement a web usage policy to protect itself and its staff, Webroot security experts recommend the following actions:
- Define your security policies With a new generation of web-based attacks, spyware, adware and webmail borne viruses, its more important than ever to develop well-thought-out and clearly defined web security policies.
- Embrace social media Social networks are new mediums for digital threats to an organisation. Build these into your policy and implement a set of rules that enables employees to harness all the benefits of these new technologies while protecting your business.
- Clearly communicate policies When rolling out new web security policies through an organisation, it is important to communicate these new policies to all the staff for better adherence to the policy. And regularly communicate with staff about IT and security issues.
- Block threats before they reach your network Roll out a cloud-based web security service that allows you to protect mobile employees as if they were at the office, while monitoring and enforcing your web security policies.
