Industry Poll Shocker: Employees Bypass IT Policies

A poll released today by Harris Interactive found that a good portion of workers admit that they knowingly violate IT policies so that they can get their work done. My take: those workers that didn't admit that they violate corporate compliance and security policies are liars.According to the poll of 1,347 employed adults ages 18 and up showed that 12 percent admitted to breaking policy. The poll was conducted online by Harris Interactive between February 2 and 4, and funded by mobility service provider Fiberlink.

Here's the quote from CEO of Fiberlink, from the company's statement announcing the poll:

"We see this as a mobility wake-up call for all IT managers," said Jim Sheward, CEO of Fiberlink. "IT departments nationwide spend a lot of time and money on their compliance, usage, and access policies, but they only work if people follow the rules. Without extensive and effective compliance tools that ensure that IT policies are being followed, companies could face dangerous breaches that include the loss of sensitive data, competitive intelligence, or customers' private information."

First, these poll results could apply to just about any IT security and policy compliance issue: passwords, encryption, rogue wireless access points, shutting down anti-malware when it becomes inconvenience, and the list goes on. But Fiberlink sells mobility management services, so that's their spin. Too bad the poll (or at least it wasn't communicated in the release) didn't focus on actual mobile compliance issues.

Second, enterprises need to spend on the controls that make the most sense for their tolerance to risk and need to mitigate that risk.

Third, Sheward was too tame in one of his remarks: enterprises that rely too heavily on their employees to make the right decisions when it comes to security and compliance will lose sensitive data, intelligence, customers' private information, or suffer some significant incident. It's really just a matter of time.

I think the 88 percent of respondents who said they don't bypass policies to get work down are either lying outright, or are fooling themselves. Who hasn't broken a corporate policy to expedite workflow?

Such things could include using a simpler password that is more easily remembered, or even writing down a complex password on paper. It could include copying unencrypted data to a USB drive, using home PCs to work on company files, using wireless connections with their corporate issued notebook. Users who click on links or open attachments from people they don't know, or access certain Web sites are probably violating policy. And the list could go on indefinitely. While few break all of the rules all of the time, fewer still follow all of the rules all of the time.

That's why companies that rely on end users to do the right thing and always follow security policy are heading for trouble. A certain percentage of users, no matter how small it is, will click on links they shouldn't, they'll visit Web sites they shouldn't, they'll use passwords they know are inadequate, and they'll check e-mail from the corner coffee shop wireless connection.

All of those actions jeopardize not only the end user doing them, but the security and compliance posture of the entire organization. And enterprises that don't use technological controls to thwart these behaviors are just asking for trouble.

For my security and technology observations throughout the day, follow me on Twitter.