New research finds many workers value trust more than money
Many workers and managers in the US and UK value trust in the workplace more than financial compensation, according to new research released on Tuesday.
A survey of 500 workers and managers in the US and UK conducted by Osterman Research for cybersecurity firm Cerby found that nearly half of participants (47%) said they would take a pay cut 20% in exchange for more trust from their employer.
Other features researchers found highly valued by employees included flexibility (48%), autonomy (42%) and the ability to choose the apps they need to work efficiently (39%).
Osterman and Cerby’s State of Employee Trust report examines the impact of the zero trust principles that many companies are rapidly adopting as a solution to their cybersecurity needs resulting from the use of “unmanageable applications” by employees and managers.
“Applications are intimately tied to levels of employee engagement and empowerment. If employers attempt to block these apps, which they often do, it negatively impacts trust,” observed Matt Chiodi, trust manager at Cerby, a zero-trust architecture provider for unmanageable apps. based in San Francisco.
“Sixty percent of employees said that if an app they want is blocked, it negatively affects how they feel about a company,” Chiodi told TechNewsWorld.
“The answer is not for employers to block these apps, but to find solutions that help manage these unmanageable apps,” he said.
worry about control
Security teams frown on the use of unmanageable applications, also known as shadow IT, for many reasons. “Employees come and go. An organization can end up with thousands of unused credentials accessing its resources,” explained Szilveszter Szebeni, CISO and co-founder of Tresorit, an email encryption-based security solutions company in Zurich. .
“With a mountain of dormant accesses, hackers are forced to penetrate a few that would go undetected and pave the way for infiltration of the organization via lateral movement,” Szebeni told TechNewsWorld.
Unmanageable applications can endanger an organization because it has no control over the security practices imposed on program development and management, noted John Yun, vice president of product strategy at ColorTokens, a solution provider Autonomous Zero-Trust Cybersecurity Systems in San Jose, CA
“Additionally, the organization has no control over application security update requirements,” Yun told TechNewsWorld.
Without any control over the application, organizations cannot trust it to access their environments, said Mike Parkin, senior technical engineer at Vulcan Cyber, a SaaS provider for enterprise cyber risk remediation in Tel Aviv, in Israel.
“Letting employees choose the best tool for the job, especially when running on their own equipment, is welcome,” Parkin told TechNewsWorld.
However, he claimed, “it requires a compromise with the organization struggling to vet chosen apps and employees being willing to opt out when their preferred app is not on the approved list.”
Roger Grimes, a data-driven defense evangelist at KnowBe4, a security awareness training provider in Clearwater, Fla., took a harder line on the issue.
“It is up to an organization’s cybersecurity risk managers to determine whether the risks involved are worth the benefits,” Grimes told TechNewsWorld. “You don’t want the average end user to decide what is or isn’t risky for the organization any more than you want the average passenger to fly an airplane.”
Worth the risk?
Apps are considered unmanageable because they often don’t support common security measures, such as single sign-on and automatically adding or removing users, Chiodi explained.
“It poses a risk to a business, but business users still need these apps,” he said. “Companies need to find ways to get these applications to a point where they can be managed, in order to reduce these risks.”
Labeling unmanageable applications is misleading, observed Marcus Smiley, CEO of Epoch Concepts, an IT solutions provider in Littleton, Colorado.
“They’re built without support for modern industry security standards, which makes them harder to monitor and secure,” Smiley told TechNewsWorld, “but while that means they can’t be managed like other applications, they can be managed in different ways.”
“When unmanageable applications are used, there’s always a reason for it,” he said. “Many organizations need better communication between IT and employees to clarify company policies and the reasons behind them.”
“IT should also provide channels to request apps and be proactive in providing more secure alternatives to problematic apps,” he added.
Smiley argued that in some situations, allowing unmanageable applications with monitoring is appropriate to ensure that identity management best practices and more secure configurations are implemented instead of less secure ones.
“Ultimately, there is no such thing as a risk-free cybersecurity strategy,” he noted. “Every security program – even those falling under zero trust – includes trade-offs between critical business functionality, productivity, and risk.”
A necessary balancing act
The safest approach is to have any application reviewed before adoption by a person or team with cybersecurity expertise to identify any issues that may arise from using the software or service, to ensure that the legal terms are acceptable, as well as planning for ongoing maintenance, recommended. Chris Clements, vice president of solutions architecture at Cerberus Sentinel, a cybersecurity consulting and penetration testing company in Scottsdale, Arizona.
“Unfortunately, many organizations don’t have the expertise or resources to properly assess these risks, resulting in the process not happening at all, or just as bad, dragging on for weeks or months, which hurts employee morale and productivity,” Clements told TechNewsWorld. .
“Balancing cybersecurity risks with employee needs is a practice that organizations need to take more seriously,” he said. “Allowing a Wild West approach will inevitably introduce cybersecurity risks. But on the other hand, being too strict can lead to choosing product or service solutions that are too heavily compromised in terms of usability and ease of use or simply denying approval altogether.
“These can cause frustration and cause staff to leave the organization or actively circumvent security checks,” he continued.
The overuse of zero trust principles can also add to this frustration. “Zero trust is about data, access, apps and services,” Chiodi explained. “But when it comes to building trust on the human side, companies should aim for high trust. The two aren’t mutually exclusive. It’s possible, but it will take a change in how employers use controls. of security.
“By providing employees with technology options, companies can show they trust their employees to make technology decisions that help them do their jobs better,” added Karen Walsh, principal at Allegro Solutions, a consulting firm in cybersecurity in West Hartford, Connecticut.
“By reinforcing that with education around the ‘assume compromise’ mentality,” Walsh told TechNewsWorld, “they build a stronger relationship with their staff members.”