Story image

Employees ignoring cyber risks a growing trend

20 May 2015

There is a growing disconnect between employee awareness of cyber threats and their actions, with many workers engaging in risky behaviour despite knowing the potential negative consequences.

This is a primary finding from global research sponsored by Blue Coat Systems, the provider of enterprise security, and conducted by independent research firm, Vanson Bourne.

The research included 1,580 respondents across 11 countries, and found a global trend of employees ignoring cyber risks while at work.

BlueCoat says the majority of global survey participants admitted understanding the obvious cyber threats when downloading email attachments from an unknown sender, or using social media and unapproved apps from corporate networks without permission, but this knowledge didn't curb their risk-taking.

More specifically, although 65% of global respondents view using a new application without the IT department’s consent as a serious cyber-security risk to the business, 26% admitted doing so.

Furthermore, nearly two out of five employees globally (41%) use social media sites for personal reasons at work. According to Blue Coat, this is a serious risk to businesses as cybercriminals hide malware on shortened links and exploit encrypted traffic to deliver payloads. 

“While the majority of employees are aware of cyber security risks, there are still some who take chances; thereby potentially jeopardising corporate network security,” says Damien Manuel, Blue Coat ANZ CISO.

“The consumerisation of IT and social media carry mixed blessings to enterprises.

“It is no longer feasible to prevent employees from using them, so businesses need to find ways to support these technology choices while simultaneously mitigating the security risks,” he says.

According to Blue Coat Systems, risky behaviour can leave both sensitive corporate and personal data open to being stolen and used immediately, stored for future use, or sold into a thriving black market where compromised corporate and personal identities are traded globally.

In general, two common sources of cyber threats are phishing and pornography sites, says Blue Coat.

Phishing is where cyber criminals conduct extensive research on employees’ social profiles to find information that can be used to attack organisations.

For example, an attacker may create a seemingly personalised email targeted at an IT administrator for a large enterprise using information found on social media profiles, such as the recipient’s alma mater or favourite sports team.

This email may contain malware that is downloaded once the recipient clicks on a link included in the document.

Pornography continues to be one of the most popular methods of hiding malware or malicious content, says Blue Coat.

Even though employees are generally aware of the threat posed by adult content sites, workers are still visiting these potentially dangerous sites, says Blue Coat.

Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.
Raising the stakes: McAfee’s predictions for cybersecurity
Security teams and solutions will have to contend with synergistic threats, increasingly backed by artificial intelligence to avoid detection.
Exclusive: Ping Identity on security risk mitigation
“Effective security controls are measured and defined by the direct mitigation of inherent and residual risk.”
CylancePROTECT now available on AWS Marketplace
Customers now have access to CylancePROTECT for AI-driven protection across all Windows, Mac, and Linux (including Amazon Linux) instances.