Workers visit inappropriate websites despite being fully aware of the cyber risks to their companies, research has revealed.
The research, conducted by Vanson Bourne for security firm Blue Coat Systems, found the actions of employees at odds with their awareness of the growing cyber threats facing the workplace.
This risky behavior can leave both sensitive corporate and personal data open to being stolen and used immediately, stored for future use or sold into a thriving black market, where compromised corporate and personal identities are traded globally.
>See also: Why the porn habits of your colleagues are putting your organisation’s data at risk
One source of cyber threats is the practice of phishing. Cybercriminals continuously conduct extensive research on employees’ social profiles to find information that can be used to attack organisations.
For example, an attacker may create a seemingly personalised email targeted at an IT administrator for a large enterprise using information found on social media profiles, such as the recipient’s alma mater or favourite sports team. That email may contain malware that is downloaded once the recipient clicks on a link included in the document.
Pornography continues to be one of the most popular methods of hiding malware or malicious content. Even though awareness is high of the threat posed by adult content sites, workers are still visiting these potentially dangerous sites.
The survey found that at 19%, China has the worst record for viewing adult content sites on a work device, with Mexico (10%) and the UK (9%) not far behind.
The majority of global survey participants admitted understanding the obvious cyber threats when downloading email attachments from an unknown sender, or using social media and unapproved apps from corporate networks without permission, but knowing this, did not curb their risk-taking.
Although 66% of global respondents view using a new application without the IT department’s consent as a serious cyber-security risk to the business, 26% admitted doing so.
In the UK, one-third (33%) of respondents used new applications without IT’s permission, compared to 27% in Germany and just 16% in France.
Obvious risks such as opening emails from unverified senders still happen at work. One out of five UK employees opens email attachments from unverified senders, even though nearly four out of five (78%) see it as a serious risk, whereas German (64%) and French (63%) businesses view the threat less seriously and both countries open less unsolicited emails at 16% each.
Nearly two out of five employees (41%) use social media sites for personal reasons at work – a serious risk to businesses, as cybercriminals hide malware on shortened links and exploit encrypted traffic to deliver payloads.
>See also: 'Malvertising' replaces porn as the largest mobile security threat
“The dichotomy between the awareness and actions of the employees found in this research should trouble businesses all over the world,” said Robert Arandjelovic, director of products for Blue Coat, EMEA. “While IT professionals seek to prevent cyber attacks occurring, their colleagues’ behaviour is jeopardising employers’ cyber security and ultimately their jobs.
“The consumerisation of IT and social media carry mixed blessings to enterprises. It is no longer feasible to prevent employees from using them, so businesses need to find ways to support these technology choices while simultaneously mitigating the security risks.”
