http://www.internetnews.com/stats/article.php/3636831 

By Sean Michael Kerner 
October 9, 2006

A new Cisco sponsored global study of 1,000 remote workers indicates 
that IT workers may well be engaged in more insecure activities than 
they are willing to admit.

Users are apparently aware of insecure activities, such as opening 
e-mail attachments from unknown senders; yet they still open the 
attachments and e-mails. The study, which was conducted by research firm 
InsightExpress, reveals a number of such security contradictions.

For the most part, users are aware of IT security concerns, but not 
pervasively so. Sixty-six percent of global users indicated that they 
were aware of security concerns when working remotely.

"At least one-third were not even aware that they are exposed to or 
could experience security breaches or compromises," Bruce Murphy, 
Cisco's vice president of Advanced Services, told internetnews.com.

Only 25 percent of global respondents admitted to using their work 
computers to open an unknown e-mail. However when the question about 
what they do with unknown e-mails was asked a different way, the results 
were somewhat different.

Respondents were given five choices to choose from:

1. Leave the e-mail unopened and notify IT;

2. Leave the e-mail unopened but not notify IT;

3. Open the e-mail to see who it's from but not open any attachments or 
   links;

4. Open the e-mail to see who it's from and open any attachments or 
   links; and

5. Delete it immediately without opening it.

When presented with options as to what they would actually do with the 
e-mail from an unknown sender, 44 percent of respondents admitted that 
they would open the e-mail.

A similar sort of contradiction appeared in response to questions about 
personal versus work use for respondents work computers.

On a global basis, 29 percent of respondents reported using their work 
computers for personal purposes. Yet 40 percent admitted to using their 
work computers to buy personal items and 46 percent admitted downloading 
personal files to their work computers.

"We see inconsistencies between what people say they do and what they 
propose they might do in certain cases," said Erica DesRoches, program 
manager for InsightExpress.

Twenty-one percent of global respondents admitted to allowing others to 
use their work computers and 11 percent admitted to using their 
neighbor's wireless connection.

According to DesRoches, the inconsistency of responses is one of the 
most surprising aspects of the survey and one that likely requires 
further examination to better understand.

"People understand that they should be concerned about security but they 
don't behave in secure ways," DesRoches said.

"Is that because they feel overly confident that their IT department has 
them covered in all scenarios, or is it because they are simply willing 
to take risks?"

>From Cisco's point of view the survey and its findings aren't about 
driving any Cisco product. In fact, Cisco's Murphy argued the study was 
vendor-agnostic and is really an attempt at a different type of security 
survey.

"There have been lots of surveys; most of them are very numbers driven. 
What's different here is that it gets into people's behaviors," Murphy 
said.

"What people who are sophisticated in the security space know is that 
it's not just one specific area or issue. It's primarily driven by 
people's behaviors.


_________________________________
Visit the InfoSec News store!
http://www.shopinfosecnews.org