{"id":29003,"date":"2023-01-10T15:27:03","date_gmt":"2023-01-10T15:27:03","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/10\/new-research-finds-many-workers-value-trust-over-money\/"},"modified":"2023-01-10T15:27:03","modified_gmt":"2023-01-10T15:27:03","slug":"new-research-finds-many-workers-value-trust-over-money","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2023\/01\/10\/new-research-finds-many-workers-value-trust-over-money\/","title":{"rendered":"New Research Finds Many Workers Value Trust Over Money"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n

Many workers and managers in the United States and the United Kingdom place a higher value on trust in the workplace over financial compensation, according to new research released Tuesday.<\/p>\n

A survey of 500 workers and managers in the U.S. and U.K. conducted by Osterman Research<\/a> for cybersecurity firm Cerby<\/a> found that nearly half of the participants (47%) said they\u2019d take a 20% pay cut in return for higher trust by their employer.<\/p>\n

Other characteristics researchers found highly prized by employees included flexibility (48%), autonomy (42%), and being able to choose the applications they need to work effectively (39%).<\/p>\n

The State of Employee Trust Report by Osterman and Cerby<\/a> examines the impact of zero-trust principles<\/a> that many companies are rapidly adopting as a solution to their cybersecurity needs resulting from the use of \u201cunmanageable applications\u201d by workers and managers.<\/p>\n

\u201cApplications are intimately tied to employees\u2019 levels of engagement and empowerment. If employers attempt to block those applications, which they often do, it negatively impacts trust,\u201d observed Matt Chiodi, chief trust officer at Cerby, a zero-trust architecture provider for unmanageable applications based in San Francisco.<\/p>\n

\u201cSixty percent of employees said that if an application they want is blocked, it negatively affects how they felt about a company,\u201d Chiodi told TechNewsWorld.<\/p>\n

\u201cThe answer is not for employers to block these apps, but to find solutions that allow these unmanageable apps to be managed,\u201d he said.<\/p>\n

Fretting Over Control<\/h3>\n

Security teams frown on the use of unmanageable applications, also known as shadow IT<\/a>, for many reasons. \u201cEmployees come and go. An organization may end up with thousands of unused credentials accessing its resources,\u201d explained Szilveszter Szebeni, CISO and the co-founder of Tresorit<\/a>, an email encryption-based security solutions company in Zurich.<\/p>\n

\u201cWith a mountain of dormant accesses, hackers are bound to get into a few that would go unnoticed and pave the way to infiltrate the organization via lateral movement,\u201d Szebeni told TechNewsWorld.<\/p>\n

Unmanageable applications can endanger an organization because it has no control over the security practices imposed on the development and management of the programs, noted John Yun, vice president of product strategy at ColorTokens<\/a>, a provider of autonomous zero-trust cybersecurity solutions in San Jose, Calif.<\/p>\n

\u201cAlso, the organization has no oversight in the security update requirements of the applications,\u201d Yun told TechNewsWorld.<\/p>\n

<\/p>\n

<\/p>\n

\n
\n

ADVERTISEMENT<\/p>\n

\"Crank<\/a> <\/div>\n<\/p><\/div>\n

<\/center><\/p>\n

Without any control over the application, organizations can\u2019t trust it with access to their environments, maintained Mike Parkin, a senior technical engineer at Vulcan Cyber<\/a>, a provider of SaaS for enterprise cyber risk remediation in Tel Aviv, Israel.<\/p>\n

\u201cLetting employees choose the best tool for the job, especially when it\u2019s running on their own equipment, is welcome,\u201d Parkin told TechNewsWorld.<\/p>\n

However, he asserted, \u201cIt does require some compromise with the organization putting in the effort to vet the chosen applications and employees willing to abstain when their preferred app isn\u2019t on the approved list.\u201d<\/p>\n

Roger Grimes, a data-driven defense evangelist at KnowBe4<\/a>, a security awareness training provider in Clearwater, Fla., took a harder line on the issue.<\/p>\n

\u201cIt\u2019s up to the cybersecurity risk managers of an organization to determine if the risks incurred are worth the benefits,\u201d Grimes told TechNewsWorld. \u201cYou don\u2019t want the average end user deciding what is or isn\u2019t risky for the organization any more than you want the average passenger flying an airplane.\u201d<\/p>\n

Worth the Risk?<\/h3>\n

Applications are considered unmanageable because they often don\u2019t support common security measures, such as single sign-on and automatically adding or removing users, explained Chiodi.<\/p>\n

\u201cThat presents a risk to a business, but business users still need those applications,\u201d he said. \u201cBusinesses need to find ways to bring those applications to a point where they can be managed, so those risks are reduced.\u201d<\/p>\n

Labeling applications unmanageable is misleading, observed Marcus Smiley, CEO of Epoch Concepts<\/a>, an IT solutions provider in Littleton, Colo.<\/p>\n

\u201cThey are built without support for modern, industry security standards, which makes them harder to monitor and secure,\u201d Smiley told TechNewsWorld, \u201cbut while this means they can\u2019t be managed like other applications, they can be managed in different ways.\u201d<\/p>\n

<\/p>\n

<\/p>\n

\n
\n

ADVERTISEMENT<\/p>\n

\n\"Drexel<\/a><\/p>\n

\nDecode Your Future with an Online Computer Science Degree from Drexel<\/span>
\nDrexel University’s online computer science programs are designed to prepare you for work on the cutting edge of technology. The curriculum is designed for students with any level of experience or previous knowledge. Request Information \u00bb<\/a><\/span><\/div>\n<\/div><\/div>\n<\/p><\/div>\n

<\/center><\/p>\n

\u201cWhen unmanageable applications are being used, there is always some reason why,\u201d he said. \u201cMany organizations need better communication between IT and employees to clarify company policies and the reasons behind them.\u201d<\/p>\n

\u201cIT should also provide channels to request applications and be proactive in providing more secure alternatives to problematic ones,\u201d he added.<\/p>\n

Smiley maintained that in some situations, allowing unmanageable applications with oversight is appropriate to ensure that best-identity-management practices and more-secure configurations are implemented instead of less secure ones.<\/p>\n

\u201cUltimately, there\u2019s no such thing as a risk-free cybersecurity strategy,\u201d he noted. \u201cEvery security program \u2014 even those that fall under zero trust \u2014 includes trade-offs between mission-critical business functionality, productivity, and risk.\u201d<\/p>\n

Balancing Act Needed<\/h3>\n

The safest approach is to have any application reviewed prior to adoption by a person or team with cybersecurity expertise to identify any issues that may arise from the software or service\u2019s use, ensure the legal terms are acceptable, as well as plan for ongoing maintenance, recommended Chris Clements, vice president of solutions architecture at Cerberus Sentinel<\/a>, a cybersecurity consulting and penetration testing company in Scottsdale, Ariz.<\/p>\n

\u201cUnfortunately, many organizations do not have the expertise or resources to properly evaluate these risks, resulting in the process not occurring at all, or just as bad, dragging on for weeks or months, which harms employee morale and productivity,\u201d Clements told TechNewsWorld.<\/p>\n

\u201cBalancing cybersecurity risk with employee needs is a practice that organizations need to take more seriously,\u201d he said. \u201cAllowing a Wild West approach will unavoidably introduce cybersecurity risks. But on the other hand, being overly stringent can lead to choosing product or service solutions that are too heavily compromised in usability and user convenience or simply denying approval altogether.\u201d<\/p>\n

<\/p>\n

<\/p>\n

\n
\n

ADVERTISEMENT<\/p>\n

\"Enhance<\/a> <\/div>\n<\/p><\/div>\n

<\/center><\/p>\n

\u201cThese can cause frustration and lead personnel to leave the organization or actively subvert security controls,\u201d he continued.<\/p>\n

Misuse of zero-trust principles can also add to that frustration. \u201cZero trust is for data, access, applications, and services,\u201d Chiodi argued. \u201cBut when it comes to building trust on the human side, companies need to be aiming for high trust. The two are not mutually exclusive. It is possible, but it\u2019s going to take a change in how employers use security controls.\u201d<\/p>\n

\u201cBy giving employees technology options, companies can show that they trust their employees to make technology decisions that help them do their jobs better,\u201d added Karen Walsh, principal at Allegro Solutions<\/a>, a cybersecurity consulting company in West Hartford, Conn.<\/p>\n

\u201cBy reinforcing this with education around the \u2018assume compromise\u2019 mentality,\u201d Walsh told TechNewsWorld, \u201cthey build a stronger relationship with their workforce members.\u201d<\/p>\n<\/p><\/div>\n