2007-10-31 15:53:53 -
www.isaca.org - ISACA Kristen Kessinger, + 1.847.660.5512 news@isaca.org or Ketchum Edward Pachetti, + 1.646.935.4172 edward.pachetti@ketchum.com A national survey of U.S. white-collar workers commissioned by the nonprofit, independent organization ISACA (formerly the Information Systems Audit and Control Association) has found that more than one-third (35%) of employees have violated their company's information technology (IT)
policies at least once and that nearly one-sixth (15%) of employees have used peer-to-peer filesharing at least once at their place of business, opening the door to security breaches and placing sensitive business and personal information at risk.
"Considering that companies rely on their IT infrastructure to store and transmit sensitive company, employee and customer data, risky activities including the ones this survey reveals are of significant concern for all businesses," said John Pironti, member of ISACA's Education Board. "A single seemingly harmless activity, such as using peer-to-peer networks while at work, can breach the confidentiality and security of an entire corporate network, including all of the documents, data and internal communications that reside on that network. On average, at a company of 1,000 white-collar employees, up to 70 employees are likely using peer-to-peer file sharing while at work often or very often, based on the survey findings. Companies and employees should be very concerned about their personal and corporate data in light of this information."
However, the opposite seems to be true. For example, the telephone survey found that 65% of white-collar professionals are either not very concerned or not concerned at all about their privacy when using a workplace computer. A surprising 63% are not very concerned or are not concerned at all about the security of their information while at work.
Additionally, most employees have the misconception that these behaviors pose little to no risk to their companies. Of respondents who said they engaged in these practices, the behaviors they deem to have the least risk include:
-- Downloading personal software onto a work computer--74% of those who have done this believe it is not a risky behavior, even though they may unintentionally install spyware or malware on the work computer.
-- Checking personal e-mail from a work computer-- 73% of those who have done this at work believe it is not risky, despite the fact that they could unknowingly download a virus that infects the corporate network.
With more than 65,000 members in 140 countries, ISACA (www.isaca.org) is a recognized worldwide leader in IT governance, security, control and assurance. Founded in 1969, ISACA sponsors international conferences; publishes the Information Systems Control Journal; and develops international information systems auditing and control standards. It also administers the globally respected Certified Information Systems Auditor (CISA) designation, earned by more than 50,000 professionals since 1978; the Certified Information Security Manager (CISM) designation, earned by 7,000 professionals since 2002; and the new Certified in the Governance of Enterprise IT (CGEIT) designation.
Survey Methodology
This summary is based on the findings of a telephone survey conducted by MARC Research during the period August 23, 2007, and September 6, 2007, among 301 U.S. white-collar workers who work for businesses with 100 or more employees. The total results reported are at the 95% confidence level with a margin of error of +/- 6%.
Nonprofit IT association survey reveals alarming computer behavior
