Most enterprise IT officials believe their company's employees pose a greater threat to data security than any outside source.
Those are the findings of the third and final set of results from a data-leakage study commissioned and released by Cisco. The first part dealt with common employee data-leakage risks and the potential impact on the collaborative workforce, and the second part focused on employees' tendencies to break company IT security rules.
All three sets of data drew from surveys of more than 2,000 employees and IT professionals in 10 countries. InsightExpress, a US market research firm, conducted the surveys.
On the topic of internal threats, the study found that while the majority of security threats exist outside an organization, the "insider threat," whether it's accidental or malicious, can be as prevalent as any external source.
Thirty-nine percent of IT officials surveyed perceive negligence among employees as the main reason for the data security risk, while one in five pointed to disgruntled workers as the source. One in three IT respondents said portable hard drive devices are their top concern for how data is leaked -- more than e-mail (25 percent), lost or stolen devices (19 percent) and verbal communication with non-employees (8 percent).
One in 10 employees surveyed admitted stealing data or corporate devices, selling them for a profit, or knowing fellow employees who did. This finding was most prevalent in France, where 21 percent of employees admitted knowledge of this behavior.
About one in 10 employees lost or had a corporate device stolen in the year leading up to the study, Cisco said.
Some employees admitted keeping their corporate devices and information after leaving their jobs, and their reasons varied from personal to vindictive: "I needed the device for personal use"; "I wanted to get back at my company"; and "The company won't find out," were some of the responses to the Cisco survey.
Interestingly, the study also found that IT broadly believes employees are becoming more cognizant of security risks and are more diligent in protecting data. For example, four of every five IT professionals in China and one of every two in France believe their employees have become more committed to protecting corporate information over the past few years, the Cisco study found.
Cisco is presenting the study's findings Wednesday during its IT Security Virtual Conference.
