Employees accessing workplace IT systems from holiday may be cyber security risk

Organisations are taking serious security risks by allowing employees to access workplace IT systems remotely while on their summer holiday, a telecoms company has warned. According to research by the corporate IT and cyber-security arm of Deutsche Telekom, nearly a third of employees (31 percent) use free Wi-Fi hotspots, and nearly a quarter (24 percent) use them for work-related emails and documents.  These are a big danger area as they are insecure and easy for hackers to clone (getting access to all email and web traffic, including any work documents and passwords). It also warns that 28 percent of employees email work documents to and from their personal email, despite this creating numerous security problems.  Ten percent use free USB charging points at airports and stations; and these ports can be used to transfer viruses and malware to unsuspecting users. The blame cannot solely be placed on the employees though, as just 28 percent of employees have never in their working career had any cyber security training to protect themselves and their employer.

T-Systems’ research, which was conducted by market research agency Censuswide into over 2,000 UK employees found that many of the threats are avoidable. Scott Cairns, the UK head of cyber security at T-Systems, said: “Time away from our hectic work life should be treasured, not spoilt by an expectation we will respond to work emails and requests. Putting aside the impact on our families, this practice also creates a real cyber-security threat for organisations. Our research shows a third of employees use free Wi-Fi at locations such as those at airports, hotels, coffee shops and bars, despite these being unsecure and open to communication interception by cyber criminals. Couple this with the widespread practice of employees emailing documents to their private email on their own devices, where security is invariably lower, and you open your organisation to potential attacks. Our message to businesses for the holiday season is ‘let your employees enjoy an uninterrupted break’. Strongly discourage them from taking work on holiday, and make sure employees do not feel pressured to work when they should be taking time out.

“Where it is unavoidable, businesses should ensure there is training, and clear guidelines to be followed. This training is particularly important, as our research shows many employees are not knowledgeable on the multitude of ways their devices can be infected with viruses and malware… and those who thought they were ‘very knowledgeable’ frequently gave the wrong answer when questioned. We’ve already begun to see the financial impact these malware attacks have had on multinationals in 2017, including Reckitt Benckiser and Mondelez (the maker of Cadbury chocolate).  Reckitt disclosed to the Financial Times this month that it expected sales would be hit by an estimated £110m this year as a direct result.

“Employees can be an easy scapegoat for poor corporate cyber-security practice, however many do not receive adequate training from their employer. Our research found that despite the pace at which cyber-attacks are evolving, 66% of respondents had received no up-to-date education within the past twelve months. Nearly 30% of respondents say they have never had cyber security education at any employer.

Training for all employees is particularly important as the dangers continue when employees come home from holiday, as T-Systems’ research also found that:

• 18 percent of employees admit to connecting their digital camera to their work computer to download photos.  And don’t think that Wi-Fi and Bluetooth connections are safer, viruses and malware can just as easily transfer through wireless connections and then quickly spread through the organisation.
• 15 percent admit to connecting USB sticks and memory cards that they share with their family members to their work computer.  A sure way for viruses to quickly spread from home to business.