Study Shows Employees Undermine Traditional IT Security Strategies

Jan 14, 2009 1:57 PM

Absolute Software and the Ponemon Institute announced the findings of a new study on the use of encryption on laptops by employees within corporations in the U.S. The study, "The Human Factor in Laptop Encryption: US Study," revealed that more than half (56 percent) of business (non-IT) managers polled, disable the encryption solution on their laptops. Ninety-two percent of IT security practitioners report that someone in their organization has had a laptop lost or stolen and 71 percent report that it resulted in a data breach. Results indicate that it is employee behavior that undermines data protection efforts in corporate America.

"The data suggests that, because of user behavior, encryption alone is not enough to protect mobile devices and the sensitive data stored on them," said Dr. Larry Ponemon, chairman and founder of The Ponemon Institute. "These statistics are especially disconcerting when combined with our recent studies demonstrating that lost or stolen laptops are the number one cause of data loss, with 3 out of 4 companies experiencing a data breach when a laptop has been lost or stolen."

The report shows that many business managers fail to take necessary precautions to secure their laptops, such as using additional security solutions, and instead are overly dependent on their encryption solutions to protect the sensitive data on their laptops. Key findings include:

- 92% of IT security practitioners report that someone in their organization has had a laptop lost or stolen and 71% report that it resulted in a data breach;
- 56% of business managers have disengaged their laptop's encryption;
- Only 45% of IT security practitioners report that their organization was able to prove the contents of missing laptops were encrypted;
- Only 52% of business managers - employees most likely to have access to the most sensitive data (personally identifiable information and/or intellectual property) - have employer-provided encryption;
- 57% of business managers either keep a written record of their encryption password, or share it with others in case they forget it;
- 61% of business managers share their passwords, compared to only 4% of IT managers; and,
- Business managers are much more likely than IT security practitioners to believe encryption makes it unnecessary to use other security measures for laptop protection.

Want to use this article? Click here for options!
© 2012 Penton Media Inc.

This month in Access Control

• Targeting The Customer
• Electronic Pedigrees
• One Hero Among Many
• Who? What? When? Where? Why?
• More from September's issue