Employees ignoring cyber risks a growing trend

There is a growing disconnect between employee awareness of cyber threats and their actions, with many workers engaging in risky behaviour despite knowing the potential negative consequences.

This is a primary finding from global research sponsored by Blue Coat Systems, the provider of enterprise security, and conducted by independent research firm, Vanson Bourne.

The research included 1,580 respondents across 11 countries, and found a global trend of employees ignoring cyber risks while at work.

BlueCoat says the majority of global survey participants admitted understanding the obvious cyber threats when downloading email attachments from an unknown sender, or using social media and unapproved apps from corporate networks without permission, but this knowledge didn't curb their risk-taking.

More specifically, although 65% of global respondents view using a new application without the IT department's consent as a serious cyber-security risk to the business, 26% admitted doing so.

Furthermore, nearly two out of five employees globally (41%) use social media sites for personal reasons at work. According to Blue Coat, this is a serious risk to businesses as cybercriminals hide malware on shortened links and exploit encrypted traffic to deliver payloads.

"While the majority of employees are aware of cyber security risks, there are still some who take chances; thereby potentially jeopardising corporate network security," says Damien Manuel, Blue Coat ANZ CISO.

"The consumerisation of IT and social media carry mixed blessings to enterprises.

"It is no longer feasible to prevent employees from using them, so businesses need to find ways to support these technology choices while simultaneously mitigating the security risks," he says.

According to Blue Coat Systems, risky behaviour can leave both sensitive corporate and personal data open to being stolen and used immediately, stored for future use, or sold into a thriving black market where compromised corporate and personal identities are traded globally.

In general, two common sources of cyber threats are phishing and pornography sites, says Blue Coat.

Phishing is where cyber criminals conduct extensive research on employees' social profiles to find information that can be used to attack organisations.

For example, an attacker may create a seemingly personalised email targeted at an IT administrator for a large enterprise using information found on social media profiles, such as the recipient's alma mater or favourite sports team.

This email may contain malware that is downloaded once the recipient clicks on a link included in the document.

Pornography continues to be one of the most popular methods of hiding malware or malicious content, says Blue Coat.

Even though employees are generally aware of the threat posed by adult content sites, workers are still visiting these potentially dangerous sites, says Blue Coat.