Cybersecurity Awareness Series: Risk is inherent in the modern workforce

This series is meant to empower organizations with key indicators on the current state of cybersecurity. As the only security provider embedded in the firmware of more than 600 million devices, Absolute’s unique position enables a more complete picture – and a single-source-of-truth intelligence to empower IT and security teams to eliminate potential blind spots and minimize risk exposure.  

Leveraging millions of anonymized data points adapted from a global customer base, this series will feature insights into device and application health, device mobility, sensitive data exposure, and more – with detailed views by vertical, region, and organization size.  

Workforce realities elevating risk exposure

Looking back to Part 1 of this Cybersecurity Awareness Series, the increasing number of vulnerabilities affecting corporate devices was highlighted as a factor increasing the attack surface for organizations. This is somewhat of an obvious link to the potential of a cyberattack. There are however many other factors that inherently increase risk for your company.

Two of these less obvious risks will be identified in Part 2 of this series. They are sensitive data storage and the increasing mobility of the workforce. These factors are unfortunately very difficult to wrangle and are tied to the modernized nature of work that occurs today.

Sensitive data storage increases attack surface

Although every endpoint represents a potential target for cybercriminals, those containing sensitive data - such as PII (Personally Identifiable Information) and PHI (Protected Health Information) - pose a more serious threat. If a device containing such information is compromised, the potential damaging implications to the organization multiply exponentially.

How big of an issue is this? One might think that this information is highly restricted to a limited number of devices. Unfortunately, that assumption is misguided. Due to the fact that workforces are now highly distributed, mobile workers are consistently connecting into various databases containing sensitive information from a variety of locations and networks.

This inherently increases the likelihood of workers storing data locally (on the endpoint itself). This locally stored sensitive data increases the potential attack surface.

Absolute’s analysis found that more than three fourths (76%) of enterprise devices contained sensitive data, on average. The Financial Services vertical – perhaps unsurprisingly – showed the highest proportion of devices with sensitive data stored (84%).

One finding of note was that the percentage of devices with sensitive data increases as the number of users within an organization decreases. In the graph below you’ll see ‘number of users’ tiered out from Tier 1 (7000+ users) all the way down to Tier 5 (10-99 users). While 78% of Tier 5 organizations’ devices contained sensitive data, only 52% of Tier 1 organizations’ endpoints did. This may indicate that organizations with a lower number of employees have a more difficult time restricting the distribution of sensitive data.

Absolute’s data also showed that a lower percentage of devices in North America contained sensitive data than those in EMEA or APJ, despite those regions having stricter compliance requirements in many cases.

Highly mobile users elevate risk exposure

The risk of sensitive data on devices is only magnified by the increase in highly mobile users of endpoints. If a device is used in multiple locations, connecting from multiple networks (outside of the locked down home/office network), the risk of a threat actor gaining unwarranted access increases dramatically.

Absolute’s analysis found that the Professional Services, Government, and Retail verticals had devices that were the most mobile, connecting from more than four separate locations in the month of August 2022 on average.

That said, all verticals shown below had endpoints that were connecting in from more than three locations per day, outside of Education. This may not be surprising given the inherently mobile nature of employees today. However, paired with the above numbers from the analysis on sensitive data, it’s evident that corporate endpoints are at an increased risk of compromise.

Absolute's analysis also noted that devices in EMEA and APJ have connected from more locations than those in North America and LATAM.   

The bottom line

This analysis showcases the fact that risk is inherent in the modernized workforce. Many employees, especially in certain verticals, rely on sensitive information to do their jobs effectively. Additionally, many workers must travel and connect from multiple locations per day in order to complete their tasks.

Organizations must therefore have the visibility required and security controls in place to ensure that their endpoints remain secure. Knowing the number of devices that contain sensitive information for example, as well as ensuring the security applications on those devices are self-healing can allow IT and security professionals to mitigate the risk of compromise substantially.

For more information on what Absolute Software can do to ensure the security of your endpoints, schedule a conversation with one of our specialists.