The risk management company claims companies are wasting money on expensive security measures and procedures that can actually increase an organizations' vulnerability to attackers instead of reducing it.

Jay Heiser, chief analyst at TruSecure, told ZDNet UK that most unauthorized access occurs inside an organization because users leave their desktops unattended and unprotected: "When someone sits down at a logged-in terminal they are able to rifle through that user's files and send or read their email. Screen-locking--activating a password-protected screensaver--is one of the most effective things you can do internally," he said.

Heiser said that when users are given long and complicated passwords, they are more likely to write them down: "They are going to write them down on Post-it notes next to their monitor or stick them under the keyboard," he said.

[ Read more ]