Lax internet rules put employers at risk

More UK firms are offering employees access to the internet but many are failing to sort out security policies until it's too late

Most UK companies now provide their employees with internet and email facilities but this has led to more employees abusing their cyberspace privileges, because firms are not enforcing a security policy, according to a survey carried out on behalf of the Department of Trade and Industry.

The DTI's Information Security Breaches Survey found that 89 per cent of employees now have access to the internet, up from 69 per cent two years ago. But, worryingly, the number of companies that restrict access to inappropriate websites has fallen from 34 per cent to 15 per cent. Additionally, only 16 per cent of respondents said that they blocked or quarantined email. Two years ago, this figure was 57 per cent.

Chris Potter, a partner at PricewaterhouseCoopers, said that most companies - especially small- and medium-sized businesses - are waiting until they experience a "major breach" in security before putting "effective controls" in place.

"Only one in three companies that suffered an incident involving internet abuse already had a contingency plan in place to deal with it. Where such plans did exist, however, most proved very effective at handling the problem," he said.

Johanna Severinsson, marketing director of EMEA at internet management company Websense, said that providing unrestricted internet access is not only a distraction for employees but raises "serious security implications" for companies.

"Every company with internet access has a responsibility to ensure it is managed in order to protect both their shareholder value and their employees," she said.

The survey was compiled from about 1,000 telephone interviews carried out by PricewaterhouseCoopers, funded by Microsoft, Computer Associates and Entrust, among others. The full results will be published during the InfoSecurity Europe conference in London next week.