Employees continue to ignore security policies

A new survey has confirmed what every IT manager already knows, that internal staff members are continuing to ignore corporate security policies, and are engaging in activities that could put the company at risk.

A large number of employees copy secure data to USB drives or turn off security settings in mobile devices like laptops, which could put a company's data at risk, according to a survey released by Ponemon Institute.

The rate of noncompliant behaviour was worse in this most recent survey compared to a similar survey conducted in 2007, Ponemon Institute said in a press release.

Around 69 percent of the 967 IT professionals surveyed said they copied confidential company data to USB sticks, even though it was against the rules. Some even lost USB sticks that store confidential corporate data, but did not report it immediately, the survey said.

The survey also took into account new technologies that could bring rogue software to computers, like social networking. Close to 31 percent of respondents engaged in social-networking practices on the web from work PCs. Additionally, around 53 percent said they downloaded personal software on corporate PCs, which could increase the risk of bringing malware to the workplace.

Mobile technologies that let employees do more while on the road are contributing to the issue, said Larry Ponemon, chairman and founder of Ponemon Institute, in a blog entry. As the use of mobile devices grows, the inability to enforce data security policies could increase the possibility of data breaches. "I'm seeing a confluence of conditions that appear to be contributing to this challenge to data integrity," he said.

Some professionals surveyed blamed companies for poor training or ineffective data security policies. Close to 57 percent said their company's data protection policies were ineffective, and 58 percent said they were not provided with enough data-security-related training.