Report claims restrictive email policies create security risks

The report - Generation Gmail Part 2 - indicates that IT departments are fighting something of a losing battle when it comes to staff data handling behaviour from IT security policies on their own.

The survey for the report, which took in 2400 responses worldwide and more than 1000 in the UK, revealed that IT workers want to be able to use their email as flexibly in the workplace as they can in their personal lives.

As a result, Mimecast says that, when staff are unable to work in the way that they want using corporate technology, they work around these issues by using their personal email accounts.

Researchers found that 79% of people send work emails from their personal email accounts, with around one fifth saying they do this on a regular basis.

Interestingly, it seems that awareness of the security risks this poses does not seem to prevent this behaviour; 71% of people questioned recognise that there is an additional risk in sending work documents outside the corporate email environment. Just less than half of respondents, meanwhile, still think it is acceptable to send work emails and documents to personal email accounts.

Mimecast also reports that the limitations imposed by corporate IT seem to be a major driver for this behaviour, with 40% of respondents saying that an unlimited work mailbox would make them less likely to use their personal email account for work purposes.

The research reveals that, where email policies exist in the organisation, only 42% covered email management, appropriate use of email (88%) and only 30% include issues relating to email retention.

Commenting on the results, Peter Bauer, Mimecast's CEO, said that email policies need to evolve to reflect the high levels of sophistication amongst email users today - and the changing communications landscape within companies.

"Although individuals are seemingly aware of the risks of sending work documents outside the corporate email environment, this awareness is not translating into safe behaviour", he said.

Bauer went on to say that a significant proportion of employees still believe that sending work documents to personal emails is an acceptable practice.

"Getting employees to care about this risk is only part of the solution; employers must take responsibility for closing this disconnect through a holistic effort encompassing email systems, policy and culture", he explained.

"The most progressive companies will be those whose email systems and policies support the needs of both the business and its employees."

What’s hot on Infosecurity Magazine?