August 28, 2008

Most IT staff would steal company secrets: survey

One third of IT staff keep passwords on post-it notes

By Computerworld UK reporter

Most IT staff would steal sensitive company information, including CEO's passwords and customer details, if they were laid off, according to a new survey from Cyber-Ark.

A staggering 88 percent of IT administrators admitted they would take corporate secrets, if they were suddenly made redundant. The target information included CEO passwords, customer database, research and development plans, financial reports, M&A plans and the company's list of privileged passwords.

The research also revealed that, of that 88 percent, a third would take the privilege password list to gain access to valuable documents such as financial reports, accounts, salaries and other privileged information.

Identity management firm Cyber-Ark conducted the survey of 300 IT professionals in its annual review 'Trust, Security & Passwords'.

Udi Mokady, co-founder and chief executive of Cyber-Ark, said that company directors were "blissfully unaware" of the administrative or privileged passwords information that IT staff have access to. "These privileged identities, which lie on hundreds of servers and applications, very rarely get changed as it is often considered too much hassle. When people leave the organisation, they can often still access the network using these passwords to acquire an organisations’ most sensitive information,” he said.

IT administrators are not exempt from keeping sloppy security habits. The survey found that one third of IT staff still keep passwords on post-it notes. And 35 percent admitted to sending highly confidential information via email or couriers.

The survey also found that one third of IT staff admitted to snooping around the network, looking at highly confidential information, such as salary details and people’s personal emails.

Mokady warned companies to routinely change and manage passwords. “You can install the best security systems in the world, but if your staff do not respect the information they are entrusted with, then the information will definitely go astray – just as the findings of this survey have illustrated.”

A quarter of companies surveyed admitted to suffering from internal sabotage and/or cases of IT security fraud. One third of companies believe that industrial espionage and data leakage is rife, with data being leaked out of their companies and going to their competitors or criminals, usually via high gigabyte mobile devices such as USB sticks, iPods, Blackberry’s and laptops or even sent over email.

Newsletters

Sign up to our Weekly Round-Up for the past week’s not-to-be-missed news analysis and insight delivered straight to your inbox.