A survey conducted by Kaspersky The study revealed that 90% of security errors in corporations were committed by users who believed they knew exactly what they were doing. Whether due to a lack of knowledge or a limited understanding of the actions to be taken, the study demonstrated that there is still a large information gap in corporate structures, especially regarding issues related to the protection of devices used in home offices, virtual machines, and the need for operating system and software updates.
To reach these conclusions, Kaspersky used an unusual methodology in the study, not only asking questions about security, but also questioning respondents about their confidence in their own answers. The data was collected at the beginning of the pandemic, when the work-from-home regime was still being implemented and many companies were trying to understand this new format, while digital scams were already showing a rapid increase in effectiveness.
According to the study, employees tend to overestimate their level of knowledge about basic digital security, with 90% of the wrong answers accompanied by the notion that they believed they knew the answer or, at least, had some understanding of the topic. In the vast majority of cases, this lack of information and training could lead to serious problems in the use of remote work systems or a reduction in the importance, for employees, of updates and functional security devices.
The use of virtual machines and remote systems showed the highest rate of errors, with 601% of respondents reporting errors and 90% claiming they did not fully understand how the systems work. Second were questions related to the separation between personal and work devices, with 52% of participants getting questions wrong on this topic, but 88% confident that the incorrect actions were being taken correctly.
A significant distortion also appeared in the correct application of system updates and in recognizing the importance of such processes. According to the Kaspersky study, 501,300 participants gave incorrect answers on this point, but 921,300 respondents believed they were acting correctly.
“If employees don’t understand the danger of actions like storing confidential documents in personal storage, for example, they are unlikely to ask for help from an organization’s security or IT departments,” explains Denis Barinov, head of Kaspersky Academy and one of those responsible for the study. According to him, the research demonstrates more than just a difficulty in understanding on the part of employees, but also the presence of entrenched behaviors, even more difficult to change than a lack of knowledge per se.
CANALTECH
Portuguese 
English