UK workers aware of cyberthreats but hostile to IT departments

According to a new study, almost 80% of UK workers see regulatory and security compliance as the responsibility of everyone in an organisation. However, while awareness of issues relating to cybersecurity in the UK is high, many employees remain openly hostile to their IT department, and would actually blame the department for a hack, even if their own actions triggered a cyberattack.

Despite the prevalence of data breaches today, the way employees approach security has not changed dramatically – and in many cases is getting worse. A recent study found that while close to two-thirds of individuals are “really worried” about digital identity theft, more than one in 10 workers would share their password with a colleague, among other issues. This illustrated that, despite heightened knowledge of new threats, workers still have bad habits when it comes to both corporate and personal security.

Following on from this, another survey from identity governance provider SailPoint has found that some employees are even actively fighting against IT and their mandates in the search for efficiency. SailPoint’s 2018 Market Pulse Survey has drawn together a global survey from independent research firm Vanson Bourne of 1,600 employees at organisations with at least 1,000 employees across Australia, France, Germany, Italy, Spain, the United Kingdom and the United States. The survey found that while the UK is outperforming comparable nations on many cybersecurity fronts, there is still plenty of room for improvement.

Awareness fails to translate

According to the study, UK staff are more aware of emerging threats in today’s increasingly digitised business arena. 50% of British-based respondents told researchers they were either already comfortable enough to use AI chatbots/personal assistants or plan to do so, above the global average of 48%. At the same time, only 38% of UK participants said they did not understand what GDPR is or how it impacts on them, compared to a much higher global average of 66%. Finally, UK workers were also the most informed when it comes to the importance of compliance mandates across their business, as almost 80% believed that every employee plays a role in compliance – nearly 20% above the global average of 63%.

The heightened awareness of new technology, regulations, and threats among UK employees has yet to fully translate into reformed actions, however. SailPoint also found that the majority of respondents from Britain still played fast and loose with their personal details, including infrequent password changes, re-using passwords across different accounts, and duplicating passwords between work and personal email accounts – meaning that if hackers obtain personal details at home, rudimentary research could also see them breach an entire company.

On top of this, a shocking 16% said they would consider selling their workplace passwords to a third party. While this might indicate that many staff in the UK – where wages continue to languish below levels seen in 2008 in real terms – are unhappy with their lot at their present employers, it also opens up a major window of opportunity for billions of pounds of damage to companies and their customers. It is also narrowly higher than the global average of 15%.

Hostility

Meanwhile, on top of the fact many employees are yet to change their ways in terms of cybersecurity, many are openly hostile to the IT departments tasked with preventing breaches. At 60%, a majority of staff said they regard IT departments as a nuisance, 5% higher than the global average.

At the same time, 30% of UK participants said they prefer to purchase and deploy software without IT’s input, opening themselves up to threats like ransomware. Compounding this threat further, more than one in every ten UK employees would not contact IT immediately if they believed they had been hacked – potentially allowing malicious individuals longer to source valuable confidential information.

Despite the added risks incurred by the behaviour of employees, the survey also found that it would be the IT department which catches the blame. Although it is lower than the global average, it is surely a cause for concern in companies that a sizeable minority of 46% are so hostile toward their IT departments, they would blame them for a cyberattack if one occurred as the result of an employee being hacked.

This breakdown in trust suggests that attempts to improve cybersecurity at top firms could be plagued by issues in the coming years, unless it is addressed. Recent statistics have suggested that the average cost of a data breach at a larger firm is £20,000, a loss many firms will be keen to stamp out as quickly as possible.

Outlining actions companies could take to help turn this situation around, Juliette Rizkallah, CMO at SailPoint, said, "With hackers increasingly targeting employees as a means of entry into the enterprise with the dissipation of the traditional perimeter, securing identities is more important than ever before... The best way to address these challenges is with an identity-centric approach to cybersecurity. With identity governance, organisations can embrace the new technologies that come with the digital transformation, enabling their workforces while also providing IT the visibility and security they need in their increasingly complex IT environments. Without identity governance, organisations risk being exposed by employees’ bad habits and the rapid changes introduced through digital transformation.”