Temporary staff poses a data breach risk

Technology - News

Wednesday, 28 November 2007

Temporary workers across the UK are unwittingly exposing businesses of all sizes to information security breaches.

In the Information Open Access survey of more than 100 temporary staff, published by internet security firm Websense, the findings indicate that organisations may be unnecessarily putting their data at risk by granting temporary staff access to confidential information at the same levels as permanent employees.

The survey highlights that 87.7 per cent of respondents were able to access documents from the company network drive, 52 per cent had used a co-worker's e-mail account and 80.7 per cent had unlimited access to the Internet from their work PC.

A worrying level of apathy amongst businesses toward basic data security processes is leaving them wide open to the risk of accidental or deliberate data breaches. Only 21.1 per cent of temporary workers had signed any type of PC or Web use policy.

As businesses gear up for the busy Christmas period, the UK's 3.1 per cent (or 770,000) temporary staff will balloon to nearly 900,000. Businesses are evidently ill-prepared for the security risk this introduces.

The survey identifies three key issues propagating this security risk:

1. Information leakage

The most prominent theme to emerge from the survey results shows that temporary workers are exposing businesses to potentially large-scale information leakage where confidential data is allowed out of the organisation, either by mistake or through malicious intent.

Key findings include:

62.4 per cent had used someone else's login details to access a work PC
57.5 per cent admitted sending work documents to the wrong person
91.2 per cent were able to print any work document they liked
36.8 per cent were given access to passwords for company systems (i.e. invoicing, procurement, payroll)
52 per cent used someone else's e-mail account or a general company e-mail address
42.1 per cent were able to connect a personal device (iPod, USB key, PDA) to their work PC

2. Lack of basic data security management

Underpinning the data leakage risk is a worrying degree of apathy amongst businesses towards basic data security management. The survey indicates that the majority of businesses are failing to put business processes in place for temporary staff to protect against security breaches.

Almost eight in ten (78.9 per cent) of temporary workers said they did not have to sign a PC or Internet use policy before starting a temporary assignment. Ninety-seven per cent said they either didn't understand or had never heard of the Computer Misuse Act.

This piece of legislation includes the 'unauthorised access offence', where a person is 'committing an offence if he or she causes a computer to perform any function with intent to secure unauthorised access to or modification of any program or data held in a computer'.

3. Exposure to external threats

The survey also reveals that temporary workers are opening the doors to allow external threats such as Internet viruses or botnets to infect businesses, through a lack of automated Internet and email management.

There is also strong evidence that businesses are failing to manage the use of social networking sites, such as Facebook, MySpace, Ecademy and LinkedIn, and Web 2.0 technologies, which are a haven for cyber criminals.

Key findings include:

67 per cent of temporary workers used social networking sites during working hours
80.7 per cent had unlimited access to the Internet from the work PC
80.7 per cent could access POP e-mail like Hotmail
21.1 per cent accessed peer to peer sites like Kazaa
37.2 per cent used instant messaging to chat with friends25.5 per cent accessed download sites during work hours

Johanna Severinsson, senior marketing director at Websense, says that many businesses across the UK rely on temporary staff to help see them through the busy Christmas period. She stressed that business managers need to secure the critical data that is unwittingly being put at risk by temporary staff.

"Organisations must start managing what access their temporary staff has to confidential data so they can focus on maximising profits during the festive period rather than dealing with security holes,” Severinsson adds.

Related articles