65% of employees bypass cybersecurity measures, new study finds
1–10 of 97 posts
Re: 65% of employees bypass cybersecurity measures, new study finds
#2> Employees often view security protocols as cumbersome. Long, complex passwords, frequent logins and multi-step authentication can feel like barriers to productivity.
This resonates. Juggling Okta and 1P a few times a day is a drag
Re: 65% of employees bypass cybersecurity measures, new study finds
#3Obviously. The processes for getting an official exception to cybersecurity practices for a legitimate reason are always slow and agonizing, and the people on the other end are incompetent and condescending.
Re: 65% of employees bypass cybersecurity measures, new study finds
#4This skipped the main reason employees do this: The cybersecurity measures are widely perceived as "security theater", rather than anything that actually enhances security.
Logging me out of an application, where a re-login requires nothing more than a click, is a stupid thing to do. Blocking outgoing (not incoming) ssh is silly when I have outgoing http. Requiring MFA multiple times a day on a work computer that is already secure is overdoing it.
Re: 65% of employees bypass cybersecurity measures, new study finds
#5> Employees often view security protocols as cumbersome. Long, complex passwords, frequent logins and multi-step authentication can feel like barriers to productivity. This resonates. Juggling Okta and 1P a few times a day is a drag
I think in the security industry, password complexity requirements and frequent re-logging in have been considered bad practises for a while now. Alas they are still seen in places.
Re: 65% of employees bypass cybersecurity measures, new study finds
#6> Employees often view security protocols as cumbersome. Long, complex passwords, frequent logins and multi-step authentication can feel like barriers to productivity. This resonates. Juggling Okta and 1P a few times a day is a drag
Yes, everything is downhill from the convenience. It's the most basics of things, if there's friction or obstacles, people will go around. And, boy, do companies put up some obstacles:
Does your Intranet site not work with my password manager? Do I have to carry a hardware token generator with me, everywhere I go? Do I need to use an arcane VPN technology to get to your company-approved tool? Are you still making me rotate passwords every six weeks? Are you still making me use bad p@ssword$123 with outdated password policies? Are you logging me out of email every four hours to cycle me through the multi-step login process, even though I'm on a secured-by-you company device?
Re: 65% of employees bypass cybersecurity measures, new study finds
#7> Password Reuse: 49% of respondents use the same login credentials for multiple work applications, and 36% use the same credentials for personal and professional accounts.
If your company has multiple things you need to log in to, its doing something wrong. Having company-wide single login system is really critical for good security.
> 30% of employees share their workplace passwords with colleagues, effectively nullifying the protections offered by unique credentials or MFA.
This also suggests something is setup wrong in the company (lack of giving people correct access?). Normally sharing passwords should be harder than not sharing, if you have to log out of a global account to log in as another one.
Security is all about incentives. If employees are incentivized to act insecurely, they will. Its not the employees fault, its the people who setup the system in such a way that encourages people to act insecurely. Good security is all about aligning incentives to control risk.
Re: 65% of employees bypass cybersecurity measures, new study finds
#8Obviously. The processes for getting an official exception to cybersecurity practices for a legitimate reason are always slow and agonizing, and the people on the other end are incompetent and condescending.
Why would you make such a blanket generalization? The security team where I work is comprised of competent professionals and generally nice people to boot. Our CISO is a great guy to have a beer with. We've had our disagreements, but they've been of the "smart people championing conflicting business values having a reasonable discussion" variety.
Re: 65% of employees bypass cybersecurity measures, new study finds
#9All the time I've worked in security I've seen that detection beats prevention because of this reality, nice to see some studies on it.
(This is why we built https://crowdalert.com, amusingly)
Re: 65% of employees bypass cybersecurity measures, new study finds
#10> Password Reuse: 49% of respondents use the same login credentials for multiple work applications, and 36% use the same credentials for personal and professional accounts. If your company has multiple things you need to log in to, its doing something wrong. Having company-wide single login system is really critical for good security. > 30% of employees share their workplace passwords with colleagues, effectively nul…
> If your company has multiple things you need to log in to, its doing something wrong.
How does that work for privileged accounts?