Despite the fact that most office workers around the world claim to understand their company's security policies, they attribute almost all IT security breaches to ignorance or well-meaning attempts to circumvent overly restrictive security policies, says a survey on the subject. The latter is especially troubling, but perhaps even worse is the prevalence of what the report calls "IT free-styling," the casual disregard for the boundary between personal and private use of hardware and Internet resources, and the disregard for security policy, even if it is understood.
The Clearswift Security Awareness Survey polled 2,000 office workers in U.S., Australia, Germany, Netherlands and the UK. About 71 percent of employees reported that their company had a clear Internet policy understood by most employees. Only 3 percent of employees reported that their company had no policy; 17 percent said their company a policy that wasn't enforced and 9 percent said that their company had a policy that most employees didn't understand. Employees were also confident they understood what sort of data could be sent via e-mail (79 percent) and what was allowed on work-related social media (65 percent). The percentage of confident employees was a bit lower regarding what sort of security was in place for work related e-mail, but still high at 52 percent.
Despite the fact that most employees said they understood their company's Internet policy, however, there was still confusion and resentment surrounding it. Twenty-one percent of users listed their company's Internet monitoring as the most confusing aspect of using the Internet at work. Twenty-two percent didn't know if their Internet usage was monitored, and, of the 57 percent who did know that their usage was being monitored, 38 percent felt that their company accessed more personal Internet usage information than was necessary to maintain security.
Workers also attributed 20 percent of breaches to people trying to get their jobs done more efficiently, and 11 percent to people who were simply frustrated with unrealistic security policies. And 50 percent of users say that there are informal rules about what's really acceptable at work, despite what the official company policy says.
