...employees stealing company data, reveals LogRhythm research

Clear disconnect between perceived risk and actual behaviour, as one in five employees admit to accessing or stealing private company information while at work

10 April, 2013 – LogRhythm, the leader in cyber threat defence, detection and response, today announced the results of a survey that suggests businesses are placing too much trust in their employees when it comes to safeguarding company data. In a survey of 1,000 employers, conducted for LogRhythm by OnePoll, 80 percent do not believe any of their workers would view or steal confidential information, while three quarters (75 percent) admitted to having no enforceable systems in place to prevent unauthorised access to company data by employees. Interestingly, a third of those employers believe that they do not need such systems at all. In addition, around two thirds of companies surveyed (60 percent) do not regularly change passwords to stop ex-employees being able to access sites or documents.

However, in a corresponding survey of 2,000 employees, 23 percent admitted to having accessed or taken confidential data from their workplace, with one in ten stating that they do it regularly. The most accessed confidential data related to details of colleague salaries (38 percent) and details of colleague bonus schemes (23 percent). An astonishing 94 percent of those who had accessed confidential information or stolen company data had never been caught.

“There is a clear gap between businesses’ internal security procedures and the harsh reality of employee behaviour,” said Ross Brewer, vice president and managing director for international markets at LogRhythm. “In an era where data breaches are considered inevitable, and with the government urging for greater consideration of cyber threats within businesses, the amount of employers who are doing nothing about unauthorised access across their networks – and the even higher number who don’t perceive any risk at all when it comes to employee data theft – is staggering.”

“Even more worrying than the lack of systems in place to stop employees stealing data is that many organisations still have no idea what’s happening on their networks at all. With recent government proposals to increase the sharing of cyber threat intelligence among businesses, the first stage must be to ensure that more employers have the right level of visibility to track suspicious or abnormal behaviour on their own networks – but this is clearly not happening,” continued Brewer.

When asked, more than a quarter (27 percent) of employers could not identify the biggest threats to their confidential data, while 14 percent did not even know whether employees have stolen data – even though they believe employees would do so.

“It’s one thing to place too much trust in your employees and consequently neglect to enforce any systems monitoring unauthorised access and stealing of data. However, the fact that 14 percent of employers think their employees would steal data, and yet have no idea whether or not this has actually happened to them, is simply unacceptable. One of the main reasons why the ‘era of the data breach’ is now hitting hard and fast is that organisations just don’t have the level of visibility into their IT networks needed to secure their ever growing infrastructures. Employers therefore need to ensure they are proactively monitoring every single activity that occurs across their entire IT estate – both from the inside and the outside – rather than placing too much trust in reactive perimeter defences or security strategies focused on securing particular areas of the IT estate, which don’t give organisations any insight into anomalous network activity.”

LogRhythm advocates that is essential that organisations make better use of the data generated by networks so that data breaches – whether internal or external – can be identified before they have a chance to escalate. Using security intelligence platforms such as Security Information and Event Management (SIEM) as part of an integrated Protective Monitoring strategy enables automated, centralised collection and analysis of log data that ensures anomalous behaviour is identified as it occurs.  Developing this deep insight requires the ability to see even minor changes that may occur across the IT estate, such as files being accessed without permission or altered or copied to portable storage devices.

“As cyber threats increase in severity and complexity, organisations need to really understand the difference between ‘normal’ and ‘abnormal’ behaviour across every dimension of their electronic enterprise and give context to any anomalous network activities. Only then will employers have the necessary visibility to combat unauthorised employee activities – which will no doubt only continue to escalate with increasingly connected workplaces,” concludes Brewer.

The full findings of both surveys can be found here:

Employers: http://logrhythm.com/Portals/0/resources/LogRhythm_survey_results_4.2013_employers.pdf

Consumers: http://logrhythm.com/Portals/0/resources/LogRhythm_survey_results_4.2013_employees.pdf