5 ways employees are hampering your business security

By: Ashok Kumar, CEO and MD - RAH Infotech

The increased use of computing resources has undoubtedly benefited employees in many ways. Apart from providing instant access to all the information they may need, the internet has increased their connectivity with customers, suppliers or other business associates. However, on the flip side, unmanaged network access also has the potential to adversely affect employee efficiency and expose the organization to a number of new risks.

Employees may indulge in number of online activities that can have a negative impact on business –unauthorized file copying or downloading, connecting with remote mobile devices or misusing business mails and other official resources. In fact, corporate networks are today inundated with increasing volumes of recreational traffic generated by employees. Such recreational traffic, when left unmanaged can prematurely force organizations to upgrade their bandwidth and invest in higher capacity networks, which can put pressure on corporate IT budgets.

Apart from affecting employee efficiency and business performance, such rampant misuse of internet by insiders may even have serious legal implications for organizations. Some of the most common insider threats that organizations need to be cautious of:

Popular Apps and Recreational Sites

The younger generation of employees commonly uses online gaming and streaming media on sites like YouTube or popular social media sites, and peer-to-peer (P2P) applications for downloading and sharing large files. Networks get bombarded with a wide range of recreational internet applications that can steal bandwidth from business critical applications, leading to slow response times and lost productivity. Many companies allow the use of such video streaming sites as they serve as effective no-cost marketing and promotional platforms. This makes it that much more difficult for organizations to block access to these applications altogether.

Disgruntled or Careless Employees

Inside attacks may emerge from disgruntled or careless employees who inadvertently create situations that may lead to serious damage for the organization. In fact, employees who have the knowledge of and access to networks, data centers and admin accounts can prove to be more damaging than outsiders. Even careless workers who don’t lock their devices properly may be prone to attacks. Apart from monitoring networks, it is becoming increasingly important for organizations to train their employees on security best practices.

Social Networking

The use of social media for connecting with customers and partners has motivated companies to officially allow their marketing personnel to leverage these tools. But these applications have become a serious concern for organizations as they are now finding it difficult to prevent employees from sharing photos, videos and other personal files over these platforms. This is not just proving to be a huge distraction, but is also adversely impacting the performance of business-critical applications. Many network managers also have security concerns about the leakage of sensitive data via social media.

Evasive Malicious Apps

A large number of online applications are being specially designed to evade detection and slip past corporate firewalls by port hopping or masquerading as business-critical applications. If a port-hopping application is unable to connect to a remote host on the default port, it will jump to another port and keep trying until it finds an open port through which it can connect. Web proxies are one way that recreational traffic attempts to masquerade as harmless HTTP traffic.

The techniques employed by these types of recreational applications to evade detection are growing more and more sophisticated – to the extent that they are rapidly outpacing the efforts of organizations to bring them under control.

Lack of Application Visibility

Most organizations today have limited insight into the types of applications running on their corporate networks. In most cases, routers and firewalls lack the ability to accurately distinguish between business-critical traffic and other more trivial internet traffic. Organizations generally lack the ability to monitor application performance in real time to identify when recreational traffic is impeding key app performance and when it comes to the explosive growth of unwanted traffic. In the absence of real time monitoring of application performance, IT managers often have to struggle to resolve the issue of poorly performing applications. Increasing the bandwidth or application acceleration may address the issue to some extent, but may not always be feasible.

To effectively manage network traffic and ensure that resources are being judiciously used for important applications, IT managers need an intelligent, coordinated solution to monitor and take action to control unwanted traffic. A number of network and security solutions available today provide granular insight into all apps, users, devices, locations, and activity on the network, giving network managers the intelligence needed to keep the network and applications running at peak performance. Some of these solutions also have sophisticated controls that allow IT staff to create network polices to ensure resources for key applications, fair-share network resources, control recreational traffic, and enforce appropriate use of the network.

Organizations have to find ways to manage and prioritize how network resources are used to limit rogue internet activity without imposing heavy-handed restrictions on all users, or hurt strategic application performance. Real-time monitoring and historical statistics help IT understand what applications are running on the network and how much bandwidth each application is consuming. With real-time monitoring into network activity and rich historical reporting and trend analysis, network managers can make informed decisions about which applications, users, and traffic to control or prioritize in order to ensure reliable performance for the applications that matter most.