Corporate data security: You’re gonna need more than a policy

An alarming number of employees are ignoring data security policies and are routinely engaging in activities that could put their employer at risk, according to a survey released by Ponemon Institute Wednesday.

According to survey results, the most frequent data security offenses were employees copying secure data to USB drives, turning off security settings in mobile devices like laptops and sharing passwords. All offenses that have the potential to put a company’s data at risk.

Of the 967 IT professionals surveyed, around 69% said they copied confidential company data to USB sticks, even though they knew it was against the rules. Still worse, some employees admit that they lost USB sticks housing company data, but failed to report it immediately.

Another disturbing trend is the amount of workers engaging in online activities that raise the risk of infecting company computers with malicious software.

About 31% of respondents engaged in social-networking practices on the Web from work PCs and around 53% said they downloaded personal software on company PCs, increasing the risk of spreading malware in the workplace, according to the research.

“Mobile technologies that let employees do more while on the road are contributing to the issue, said Larry Ponemon, chairman and founder of Ponemon Institute, in a blog entry. As the use of mobile devices grows, the inability to enforce data security policies could increase the possibility of data breaches. "I’m seeing a confluence of conditions that appear to be contributing to this challenge to data integrity," he said.

Over half (58%) of the IT professionals surveyed put the blame on companies for failing to provide employees with adequate data security awareness and training. About 57% also said their company’s data protection policies were ineffective and 43% said there was poor communication and enforcement of data security policies.

“The Ponemon Institute believes these results show overall lack of urgency by companies on the need to address data security. Unfortunately, our studies have also shown that it often takes a data breach incident before an organization will finally get their wake-up call and take data security seriously.” (Dr. Ponemon’s blog)

Like the survey results showed, it’s going to take more than just a policy to ensure that your company’s data is secure and protected. Read some of these past posts for more information on not only setting up a data security policy, but also training employees on how to keep your company safe:

Employee anti-phishing training, one scam at a time

Six tips for setting up a computer security policy

Employee security training: Spam 101

Employee security training: How to catch ‘phish’

Disgruntled Chrysler employee fired after Internet post

Domino’s employee video goes viral, is poor training to blame?

When you order a pizza you generally trust that none of the toppings have landed in someone’s nose before they made it on your pizza. Right?

Sadly, there’s a new viral video sweeping the Internet that has seriously damaged customers’ trust in one of the country’s most popular pizza chains and two employees are to blame.

A couple of Domino’s employees are now unemployed and facing felony charges after posting videos of themselves defacing food while preparing it for delivery. The videos show an employee breaking various health-code standards including sticking cheese up his nose, putting nasal mucus on sandwiches and passing gas on salami before it made it onto a sandwich.

“We got blindsided by two idiots with a video camera and an awful idea,” said a Domino’s spokesman, Tim McIntyre, who added that the company was preparing a civil lawsuit. “Even people who’ve been with us as loyal customers for 10, 15, 20 years, people are second-guessing their relationship with Domino’s, and that’s not fair.” (New York Times)

Company President Patrick Doyle has posted a YouTube video of his own apologizing for the unacceptable behavior of these two infamous employees and asks that customers continue their support, despite the embarrassment it has brought to the company.

"You can be the safest driver, you know," McIntyre said. "But there's going to be that Friday night someone's drunk and comes from out of nowhere. You can do the best you can, but there's going to be the equivalent of that drunk driver that hits the innocent victim." (Advertising Age)

You hope that most employees would have enough common sense to refrain from illegal activity at work, let alone film it and post it on YouTube, but some may need a reminder from time to time.

A great way to remind employees how to act online when representing the company is through regular training. After you’ve developed a sound social media policy (read our guidelines for social media use), it’s time to explain the policy and consequences for not following that policy to employees.

How formal or informal your employee social media use training will vary depending on the nature of your business, but should give employees a clear understanding of what is considered acceptable online behavior when representing the company.

There’s no doubt that your policies and social media guidelines will change as new technologies and social networking tools emerge, so it’s best to provide training on an on-going basis.

The best way to defend your company against an unfortunate situation like what Domino’s is going through right now is through preparation. It’s impossible to control what employees will say about you online, but with clear policies, employee training and the proper planning, you’ll be in a much better place to handle any issue.

Do you think poor training could have played a role in Domino’s current dilemma? Does your organization train employees on how to represent the company online?