PCMag UK Home Software & Services Productivity Slack
The Worst Threat to Business Data Security: Employees
While information security professionals might believe employees are the best line of defense, a new Data Exposure Report found that employees are the most glaring infosec liability.
byEric Griffith Oct 03, 2019
Of the 40 million people who changed jobs last year alone, 60 percent of them took data with them, according to data backup and loss prevention company Code42. Data they probably didn't own. So it might seem a little self-serving of Code42's annual Data Exposure Report (DER) to say insider threats are the biggest problem a company faces.
But the report, while commissioned by Code42, was run by independent UK-based Sapio Research, which surveyed 1,028 information security leaders and 615 business decision-makers at companies in the US, UK, Germany, Austria, and Switzerland. Some of the responses were surprising, starting with the graphic above. If 65 percent of CEOs and 78 percent of CSOs are clicking links they shouldn't have, what do you think is happening in the cubicles?
The report goes on to mention how company-sanctioned file-sharing and collaboration platforms like Microsoft OneDrive (used by 43 percent of respondents), Google Drive (41 percent), Dropbox (33 percent), Slack (13 percent), iCloud (38 percent), and even WhatsApp (37 percent) are not only popular, but huge holes in data security. Since the apps allow users to move data outside the company, "information security teams lose visibility to data and thus the ability to protect it."
Perhaps the biggest wake-up call is that depending on who you ask, those surveyed said employee actions were responsible for either 50 or 53 percent of any data breach they'd experienced.
Infosec respondents said that external bad guys like cybercriminals account for only about 28 percent of breaches. Business decision-makers in the company were more likely to put hardware failures to blame at 25 percent, but that's still well behind employees and third-parties in the data vulnerability rankings.
Code42 and Sapio also surveyed respondents about whether they'd brought data over to the job from a previous employer. The answer to that was a resounding Yes from an average of 63 percent of them, while 38 percent were also convinced their colleagues had done the same.
Why do they do it? Because even the leaders who were asked about it, about 71 percent of them, said they took data because it represents more than corporate data: "it's my work—and my ideas." Only 1 percent of respondents strongly disagreed with that sentiment.
Other highlights: 89 percent of CSOs said they are "desensitized" to cybersecurity threats because it's all overblown by the media; same for 30 percent of the info security leaders. (Yeah, it's our fault).
The Best Online Collaboration Software for 2023
The Best Android Apps for 2023
The Best Apps in the Windows 11 Store
About Eric Griffith
I've been writing about computers, the internet, and technology professionally for 30 years, more than half of that time with PCMag. I arrived for the end of the print era of PC Magazine as a senior writer. I then served for a time as managing editor of business coverage for the website, before settling back into the features team for the last decade. I regularly write features on all tech topics, plus I run several special projects including the Readers' Choice and Business Choice surveys, and yearly coverage of the Fastest ISPs and Best Gaming ISPs.
More From Eric Griffith
Must-Watch: The Most-Streamed TV Shows and Movies This Week
What to Stream This Weekend