For any company, data leaks are a huge worry, especially when so much personal and business data is stored. Most companies know they have information that is vital to their survival and that could damage the company if it falls into the wrong hands.

A survey has revealed that insider data theft is rife in the UK and theft of data by employees is common in UK companies. The most common methods of stealing the data were USB memory sticks (23%), personal laptops (23%), other portable storage (19%), mobile phones (13%), some 72% of more than 1,000 UK employees polled by security firm Imperva admitted taking data from an employer. The survey found 26% had stolen customer data, 25% had removed HR records, 25% had taken marketing data and 10% had lifted redundancy lists.

Almost half of those polled were aware of at least one colleague who had stolen data, and 69% believed a competitor had received information in this way. Intellectual property was the prime target, followed by customer information, the survey revealed. Faced with redundancy, 37% of respondents said they would want to take information with them, but that jumped to 70% if they knew they were about to be fired.

The most obvious problem is a lack of effective controls and data securityh software within UK companies, with a quarter of those polled saying their organisations did not restrict their access to sensitive information, and where there were controls in place, 44% of employees said they could get around these measures. “Companies are their own worst enemies, and this study confirms that,” said Amichai Shulman, chief technology officer at Imperva.

This is especially important because 59% of those polled said they would take information because they believed this information was rightfully theirs, including employees changing jobs. To overcome this and curb the loss of data to competitors, employers need to understand the problem, and define what constitutes intellectual property and why they retain ownership, says Shulman.

They need to re-examine what restrictions they have in place as a matter of urgency because they are not doing the job and are being circumnavigated, he says. According to Shulman, many businesses need to create policies that cover what is sensitive information, what is unacceptable behaviour, and what the penalties are for breaching such policies.

Another area of policy that companies typically neglect is regarding the removal of corporate information from personal devices when people leave. Some 85% of respondents said they had sensitive data on their home computer or mobile, 75% had a customer database, and 27% had some form of intellectual property.

But the survey found 60% of organisations did not have a policy to cover the removal of corporate information from personal devices as employees left the company and a quarter did not have any controls to restrict access to sensitive information.

Shulman believes that once UK law requires companies to report data breaches, there will be a growing awareness of just how much data is lost through employees in the course of normal business. “Effective tools will enable organisations to express their data protection policies rules based on the information they want to control,” he says.

How Alertsec Xpress Would Have Helped

In an incident which highlights the need of a data security and recovery software, the threat could have simply be reduced to an insurance matter by a mere investment of $13/month. The information would have been secure with no loss what so ever. That is certainly a small price to pay compared to what can happen if you lose confidential or sensitive data. Alertsec Xpress offers a very good and easy-to-use laptop security service that includes more than the traditional software licensing model. Feel free to subscribe for your personal 30-day free trial.

Related articles

• All The Dirty Laundry Comes Out (lockergnome.com)
• Imperva warns of rise in Stuxnet hacking threats (v3.co.uk)