RSA “person-on-the-street” survey reveals the actions of well-meaning corporate and government employees who handle sensitive data; highlights the need to closely manage information risk
Bedford, Mass.-Monday, December 10, 2007
RSA, The Security Division of EMC (NYSE: EMC), today announced the findings of its recent insider threat survey. Conducted by RSA in early November, the person-on-the-street survey polled government and corporate office workers in Boston and Washington, D.C. on their work-related security behaviors and attitudes. The results provide a snapshot of the everyday actions of trusted insiders who have access to sensitive data such as customer information, Social Security numbers, credit card data, company financials and intellectual property.
The real insider threat lies in everyday events
The results of the survey underscore that the risk posed to data by well-meaning insiders – employees, contractors, suppliers, partners, visitors and consultants who have physical and/or logical access to organizational assets – must be as closely managed as that posed by malicious insiders who deliberately leak sensitive data for personal financial gain or other criminal purposes. These “innocent” insiders can unwittingly create data exposures of extraordinary scope and cost through their ordinary, everyday behavior, whether through carelessness, working around security measures or following inadequate security policies.
Insiders need technology and security policies that match their business needs
The survey results indicate that trusted insiders may work around unmanageable security policies in order to get their work done. For instance, employees who don’t have remote access may email a document to their personal email address so they may work on it later from home – an action that violates most organizations’ stated security policy. The survey found that:
35 percent of respondents have felt the need to work around their organization’s established security policies and procedures just to get their job done.
63 percent of respondents frequently or sometimes send work documents to their personal email address so that they can access them from home.
When trusted insiders work around security policies, usually no harm is intended. Regardless of intent, sensitive data can be exposed, subjecting the organization – and possibly consumers – to unnecessary risk. Organizations can mitigate this risk by developing information-centric policies that acknowledge and align with the needs and realities of the business. Once such policies are in place, companies should constantly measure actual user behavior against established policy and use what they learn to inform smart policy changes that minimize risk and maximize business productivity. When security is as convenient as possible for end users, they are less likely to work around security policy.
Insiders rely on remote access to sensitive information
Not surprisingly, the survey results indicate that employees depend on remote access to corporate information while on the road, waiting at airports or working in coffee shops:
87 percent of respondents frequently or sometimes conduct business remotely over a virtual private network (VPN) or web mail.
56 percent of respondents frequently or sometimes access their work email via a public wireless hotspot (i.e. a wireless Internet connection at a coffee shop, airport, hotel, etc.).
52 percent of respondents frequently or sometimes access their work email via a public computer (i.e. a computer at an Internet café, airport kiosk, hotel, etc.).
Remote access to sensitive data calls for stronger authentication than a user name and password – which can be easily and quickly defeated. Organizations can maintain the flexibility of remote access while protecting sensitive data by requiring two-factor authentication to VPNs and webmail. Additionally, companies can mitigate the risk of data loss in mobile environments by creating, monitoring, and enforcing information-centric policies.
“Organizations must understand the types of information their employees and other insiders need to access, determine the sensitivity of that information and then protect it with security measures commensurate with the associated risk,” said Sam Curry, Vice President of Product Management and Product Marketing at RSA. “Well-protected information is an asset that gives individual workers and organizations the confidence to achieve more.”
For insiders to leverage information, that information has to be free to move
The survey findings illustrate that for employees to be most productive and for information to be most valuable to an organization, information has to be free to move:
65 percent of respondents frequently or sometimes leave their workplace carrying a mobile device such as a laptop, smartphone and/or USB flash drive which holds sensitive information related to their jobs (i.e. customer data, personally identifiable information such as Social Security numbers, company financials, credit card data, and competitively sensitive information such as product plans).
8 percent of respondents have lost a laptop, smartphone and/or USB flash drive with corporate/organizational information on it.
While mobility is essential to business agility, unprotected information – whether at-rest, in-motion, or in-use – increases risk. Organizations can minimize the risk by reducing the use of sensitive and personally identifiable information wherever possible and protecting sensitive information wherever it is: in-use at personal endpoints, at-rest on corporate file systems and databases, and in-flight across corporate and non-corporate networks. Organizations may also consider establishing automatic control and enforcement actions – to allow, audit, discard, quarantine or encrypt transmission – based on the sensitivity of the data.
Insiders trust one another
Physical security is absolutely vital to overall security and yet, the survey findings reveal that sometimes people hold the door (and wireless network) wide open. The survey revealed that:
34 percent of respondents have held a secured door open for someone at work they didn’t recognize.
40 percent of respondents have been let into the building by someone that didn’t know them after forgetting their access card/key.
66 percent of enterprise respondents said that their company provides a wireless network internally for use in conference rooms and guest offices. Of those who have such a wireless network, 19 percent reported that access to the network is completely open, no credentials required.
Physical access policies are not always adequate to guarantee that only authorized insiders are in the building. And even when physical access controls are working properly, not all people with legitimate access to the building should necessarily have access to an organization’s information. To minimize risk, physical security controls should be coupled with logical access controls. Organizations can help protect sensitive data by implementing two-factor authentication to internal wireless networks, desktops, domains, ports and applications, and enforcing appropriate access controls.
Insiders change roles often
Change is a constant in organizations. Every day, roles change within the company and contractors and consultants come and go. The survey results tell us that security updates sometimes lag behind:
33 percent of respondents have switched jobs internally and still had access to accounts/resources which they no longer needed.
72 percent of respondents reported that their company/organization employs temporary workers and/or contractors who require access to critical organizational information and systems.
23 percent of respondents have stumbled into an area of their corporate network to which they believe they should not have had access.
Access to highly sensitive or personally identifiable information should be granted on a need-to-know basis. As such, organizations can reduce the risk of exposure by implementing role-based access to critical information. Companies should make certain that role changes – including those of contractors and consultants – are promptly reflected in access privileges. Finally, organizations can mitigate information risk by centrally and tightly managing insider credentials, including usernames/passwords, one time passwords and digital certificates, and developing watch lists to track and alert them to unauthorized access attempts.
“A holistic, information-centric security strategy takes people, process and technology into account and has a feedback mechanism,” said Christopher Young, Vice President and General Manager of the Identity and Access Assurance Group at RSA. “It is not enough to establish policy; actual insider behavior must be measured and tracked against established policy in order to keep security aligned with the business.”
For a report of the full survey findings and recommendations, please viewThe Confessions Survey: Office Workers Reveal Everyday Behavior That Places Sensitive Information at Risk (link: http://www.rsa.com/company/news/releases/pdfs/RSA-insider-confessions.pdf).
RSA, The Security Division of EMC, is the premier provider of security solutions for business acceleration, helping the world’s leading organizations succeed by solving their most complex and sensitive security challenges. RSA’s information-centric approach to security guards the integrity and confidentiality of information throughout its lifecycle – no matter where it moves, who accesses it or how it is used.
RSA offers industry-leading solutions in identity assurance and access control, encryption and key management, compliance and security information management and fraud protection. These solutions bring trust to millions of user identities, the transactions that they perform, and the data that is generated. For more information, please visit www.RSA.com and www.EMC.com.
For more on EMC news, events, and recent media coverage visit the news section of EMC.com. Note to editors: For further information about this release contact EMC Public Relations at [email protected]
RSA is a registered trademark or trademark of RSA Security, Inc. in the U.S. and/or other countries. EMC is a registered trademark of EMC Corporation. All other company and product names may be trademarks of their respective owners.