Businesses are leaving themselves vulnerable to IT security breaches by failing to incorporate suitable training in employee inductions, according to the findings of a European-wide survey of small and medium-sized companies.
The research suggested that while most companies valued employee inductions very highly, only 32% included security as part of that process and just 39% outlined an internet usage policy. This is despite 73% of firms claiming to have reviewed their induction policy over the past 12 months.
In some cases, this was because the company did not even have a set policy on IT security, the research conducted on behalf of McAfee suggested.
Just 39% had guidelines for employees on email content and language usage, while 28% had policies on using portable storage devices and 23% had laptop usage procedures. Taking IT equipment outside company premises is one of the most likely ways to lose both equipment and data.
Companies were more aware of the problems of spam and viruses, the survey found, with 50% providing guidelines on spam, viruses and software/file downloads.
“While many businesses make a priority of employee induction, many are failing to effectively cover a major part of any employees working life, their PC and internet usage policies,” claims Greg Day, a security analyst at McAfee.
“Companies are failing to capture the opportunity presented by new starters to instil a sense of vigilance and security into the workforce,” he added. “This oversight, coupled with a clear lack of enforcement, increases the risk of new employees either consciously or inadvertently breaching corporate security protocols.”
The research also revealed a culture of ‘responsibility roulette’, where employers and employees thought the other should take control of ensuring IT equipment and data remained safe. For example, 67% of business owners believed employees were to blame if a laptop was stolen off work premises and 55% felt employees were guilty if a personal email spread a virus on a company server.
McAfee recommends companies follow a five-point plan to ensure they have a policy on IT security and new employees are properly briefed:
Cover all the bases: ensure that existing induction materials give sufficient time to security risk exposure. This may highlight shortfalls in your businesses current approach to security
Understand existing employee perceptions: evaluate how informed the existing employee base is on security issues such as email disclaimers, spam mail and mobile working
Bring clarity to risk responsibility: start your risk review by refreshing your company’s understanding of where responsibility resides for security risk issues. Trade and government websites make a good reference point
Independent analysis: Invite an independent third party, partner business or customer to undertake your induction process and provide feedback on areas where information could be improved
Create virtual security officers: identify key personnel who can take responsibility for ensuring a vigilant approach to information security and employee awareness
