81541 München, de
+49 (20) 7401-7968
Three quarters of British employers have no enforceable systems to stop employees stealing company data, reveals LogRhythm research
Clear disconnect between perceived risk and actual behaviour, as one in five employees admit to accessing or stealing private company information while at work
However, in a corresponding survey of 2,000 employees, 23 percent admitted to having accessed or taken confidential data from their workplace, with one in ten stating that they do it regularly. The most accessed confidential data related to details of colleague salaries (38 percent) and details of colleague bonus schemes (23 percent). An astonishing 94 percent of those who had accessed confidential information or stolen company data had never been caught.
"There is a clear gap between businesses' internal security procedures and the harsh reality of employee behaviour," said Ross Brewer, vice president and managing director for international markets at LogRhythm. "In an era where data breaches are considered inevitable, and with the government urging for greater consideration of cyber threats within businesses, the amount of employers who are doing nothing about unauthorised access across their networks - and the even higher number who don't perceive any risk at all when it comes to employee data theft - is staggering."
"Even more worrying than the lack of systems in place to stop employees stealing data is that many organisations still have no idea what's happening on their networks at all. With recent government proposals to increase the sharing of cyber threat intelligence among businesses, the first stage must be to ensure that more employers have the right level of visibility to track suspicious or abnormal behaviour on their own networks - but this is clearly not happening," continued Brewer.
When asked, more than a quarter (27 percent) of employers could not identify the biggest threats to their confidential data, while 14 percent did not even know whether employees have stolen data - even though they believe employees would do so.
"It's one thing to place too much trust in your employees and consequently neglect to enforce any systems monitoring unauthorised access and stealing of data. However, the fact that 14 percent of employers think their employees would steal data, and yet have no idea whether or not this has actually happened to them, is simply unacceptable. One of the main reasons why the 'era of the data breach' is now hitting hard and fast is that organisations just don't have the level of visibility into their IT networks needed to secure their ever growing infrastructures. Employers therefore need to ensure they are proactively monitoring every single activity that occurs across their entire IT estate - both from the inside and the outside - rather than placing too much trust in reactive perimeter defences or security strategies focused on securing particular areas of the IT estate, which don't give organisations any insight into anomalous network activity."
LogRhythm advocates that is essential that organisations make better use of the data generated by networks so that data breaches - whether internal or external - can be identified before they have a chance to escalate. Using security intelligence platforms such as Security Information and Event Management (SIEM) as part of an integrated Protective Monitoring strategy enables automated, centralised collection and analysis of log data that ensures anomalous behaviour is identified as it occurs. Developing this deep insight requires the ability to see even minor changes that may occur across the IT estate, such as files being accessed without permission or altered or copied to portable storage devices.
"As cyber threats increase in severity and complexity, organisations need to really understand the difference between 'normal' and 'abnormal' behaviour across every dimension of their electronic enterprise and give context to any anomalous network activities. Only then will employers have the necessary visibility to combat unauthorised employee activities - which will no doubt only continue to escalate with increasingly connected workplaces," concludes Brewer.
The full findings of both surveys can be found here:
The use of information published here for personal information and editorial processing is generally free of charge. Please clarify any copyright issues with the stated publisher before further use. In the event of publication, please send a specimen copy to firstname.lastname@example.org.