RSA, The Security Division of EMC today announced the findings of its recent insider threat survey. Conducted by RSA in early November, the person-on-the-street survey polled government and corporate office workers in Boston and Washington, D.C. on their work-related security behaviors and attitudes. The results provide a snapshot of the everyday actions of trusted insiders who have access to sensitive data such as customer information, Social Security numbers, credit card data, company financials and intellectual property.

The real insider threat lies in everyday events

The results of the survey underscore that the risk posed to data by well-meaning insiders - employees, contractors, suppliers, partners, visitors and consultants who have physical and/or logical access to organizational assets - must be as closely managed as that posed by malicious insiders who deliberately leak sensitive data for personal financial gain or other criminal purposes. These "innocent" insiders can unwittingly create data exposures of extraordinary scope and cost through their ordinary, everyday behavior, whether through carelessness, working around security measures or following inadequate security policies.

Insiders need technology and security policies that match their business needs

The survey results indicate that trusted insiders may work around unmanageable security policies in order to get their work done. For instance, employees who don't have remote access may email a document to their personal email address so they may work on it later from home - an action that violates most organizations' stated security policy. The survey found that:

• 35 percent of respondents have felt the need to work around their organization's established security policies and procedures just to get their job done.
• 63 percent of respondents frequently or sometimes send work documents to their personal email address so that they can access them from home.

When trusted insiders work around security policies, usually no harm is intended. Regardless of intent, sensitive data can be exposed, subjecting the organization - and possibly consumers - to unnecessary risk. Organizations can mitigate this risk by developing information-centric policies that acknowledge and align with the needs and realities of the business. Once such policies are in place, companies should constantly measure actual user behavior against established policy and use what they learn to inform smart policy changes that minimize risk and maximize business productivity. When security is as convenient as possible for end users, they are less likely to work around security policy.

Insiders rely on remote access to sensitive information

Not surprisingly, the survey results indicate that employees depend on remote access to corporate information while on the road, waiting at airports or working in coffee shops:

• 87 percent of respondents frequently or sometimes conduct business remotely over a virtual private network (VPN) or web mail.
• 56 percent of respondents frequently or sometimes access their work email via a public wireless hotspot (i.e. a wireless Internet connection at a coffee shop, airport, hotel, etc.).
• 52 percent of respondents frequently or sometimes access their work email via a public computer (i.e. a computer at an Internet café, airport kiosk, hotel, etc.).

Remote access to sensitive data calls for stronger authentication than a user name and password - which can be easily and quickly defeated. Organizations can maintain the flexibility of remote access while protecting sensitive data by requiring two-factor authentication to VPNs and webmail. Additionally, companies can mitigate the risk of data loss in mobile environments by creating, monitoring, and enforcing information-centric policies.

"Organizations must understand the types of information their employees and other insiders need to access, determine the sensitivity of that information and then protect it with security measures commensurate with the associated risk," said Sam Curry, Vice President of Product Management and Product Marketing at RSA. "Well-protected information is an asset that gives individual workers and organizations the confidence to achieve more."

For insiders to leverage information, that information has to be free to move

The survey findings illustrate that for employees to be most productive and for information to be most valuable to an organization, information has to be free to move:

• 65 percent of respondents frequently or sometimes leave their workplace carrying a mobile device such as a laptop, smartphone and/or USB flash drive which holds sensitive information related to their jobs (i.e. customer data, personally identifiable information such as Social Security numbers, company financials, credit card data, and competitively sensitive information such as product plans).
• 8 percent of respondents have lost a laptop, smartphone and/or USB flash drive with corporate/organizational information on it.

While mobility is essential to business agility, unprotected information - whether at-rest, in-motion, or in-use - increases risk. Organizations can minimize the risk by reducing the use of sensitive and personally identifiable information wherever possible and protecting sensitive information wherever it is: in-use at personal endpoints, at-rest on corporate file systems and databases, and in-flight across corporate and non-corporate networks. Organizations may also consider establishing automatic control and enforcement actions - to allow, audit, discard, quarantine or encrypt transmission - based on the sensitivity of the data.

Insiders trust one another

Physical security is absolutely vital to overall security and yet, the survey findings reveal that sometimes people hold the door (and wireless network) wide open. The survey revealed that:

• 34 percent of respondents have held a secured door open for someone at work they didn't recognize.
• 40 percent of respondents have been let into the building by someone that didn't know them after forgetting their access card/key.
• 66 percent of enterprise respondents said that their company provides a wireless network internally for use in conference rooms and guest offices. Of those who have such a wireless network, 19 percent reported that access to the network is completely open, no credentials required.

Physical access policies are not always adequate to guarantee that only authorized insiders are in the building. And even when physical ac