Security versus functionality: avoiding end user revolt

Issue 1 2023 Security Services & Risk Management

One of the biggest challenges facing any CISO today is a term we call end user revolt, when users circumvent all security measures and protocols in order to do their jobs.

Wayne Olsen.

When the business puts mechanisms in place to secure its infrastructure but these hinder users from being productive, users will always find a way around them. For example, if they are unable to copy a phone number from their email to WhatsApp for business purposes, they will simply forward the mail to their private email or a web application and copy it from there to get the job done. Typically, they are not doing this with malicious intent, but to make life easier.

Not delivering what users need, or actively hampering their ability to work, inevitably leads to workarounds and ‘shadow IT’, which raises security, budgetary and compliance risks. In the modern hybrid work environment, with a proliferation of new SaaS and web applications available, it has become faster and easier than ever before for staff to find the tools and workarounds they want.

Shadow IT is thought to account for anywhere between 30% and 50% of IT spend at large enterprises today, and this proportion will grow unless IT is able to deliver what users need. While SaaS and web applications are inherently useful, a proliferation of unsanctioned SaaS and cloud tools in the environment means IT security will lose visibility of what data is being sent, and where, be unable to apply policies across the entire environment, and may even lose sight of what data exists within the organisation.

This can have serious implications for the business. Human error is one of the organisation’s biggest weak spots, so when users are taking charge of security themselves, within a shadow IT environment, nothing is safe. Mimecast’s State of Email Security 2022 report found that 83% of respondents believe their company is at risk due to data leaked by careless employees, and a past IBM Cyber Security Intelligence Index estimated that human error was the major contributing cause, up to 95%, of all breaches. Statista states that 58% of global CISOs believe human error is their organisation’s biggest cyber vulnerability.

How do CISOs achieve a balance between security and functionality, enabling agility and productivity for the business, without the risk?

Becoming a business enabler

CISOs need to evolve their role and move past being a business disabler. Traditional, dictatorial approaches to security can be seen as a hindrance to business, because they prevent the business from being agile.

You see this clearly in the misalignment between security and networking teams: for example, networking is worried about speeds and feeds, while security’s only concern is security. Operational technology teams are worried about uptime, and security’s only worry is security. When goals are misaligned in this way, you start getting end user revolt.

CISOs can no longer afford to make autonomous decisions to implement security measures without considering how these will impact users. When security measures are implemented, without consideration for how practical they are, users will simply spin up private cloud drives (like Dropbox), and take other measures that enable them to work more efficiently.

When a business unit wants to spin up a new application or service in a hurry because they are under pressure to meet revenue targets, they will bypass the CISO and security processes without considering the ramifications, because they are worried about revenue first and consequences later.

CISOs, who actively engage with business understand the business’s strategy and identify ways for security to be an enabler, will put themselves in a position to overcome end user revolt. This next generation of CISOs, also sometimes described as a ‘Chief Information Security and Business Officer’, will be the person tasked with balancing security and productivity.

The way around user revolt is to be involved in the broader business and have users buy into the concept of keeping the business secure, knowing it will not hinder their work. CISOs should consider implementing rules by department instead of having enterprise-wide policies: for example, allowing marketing teams to load data onto external drives because they need to share information with suppliers, while making it clear that security will monitor the nature of the data they are copying. Conversely, not allowing receptionists to copy data onto drives because there is no business reason for them to do so.

Security needs to be driven from the top down, with security-driven scorecards on the security impacts of any new project, and security needs to be built into every procedure from the ground up.

In a world where time is money and no business can afford to lag behind the competition, CISOs have to work harder to make security an enabler, not a disabler.

For more information, contact BCX, Wayne Olsen, +27 11 266 1000,,


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Three new portable power stations to ease load shedding
News Security Services & Risk Management Products
EcoFlow has launched three portable power stations that provide sufficient power for consumers wherever they are; the DELTA 2 and RIVER 2 Series are feature-filled power solutions to the volatile electricity supply.

You cannot bribe a computer
Access Control & Identity Management Security Services & Risk Management
Corruption is a cancer that destroys the prospects and stability of countries and businesses. It widens wealth gaps and punishes the poor. It costs countries many billions in lost revenue.

How much protection does cyber insurance really give businesses?
Cyber Security Security Services & Risk Management
If organisations don’t meet even the minimum requirements of security and data protection, insurance will do them little good. Instead, it needs to be just one part of the digital resiliency toolbox.

Off-grid power solution for residential estate
Editor's Choice Security Services & Risk Management Residential Estate (Industry) Products
Coral Beach Estate, an upmarket residential estate based in East London, has been struggling with load shedding and power outages due to South Africa's energy crisis, as well as the vandalism of its power infrastructure.

SafeCity Guarding rolls out across 14 suburbs in Johannesburg
News Security Services & Risk Management
In a major drive to provide communities across Johannesburg with additional safety, Vumacam, in partnership with Fidelity ADT and other security providers across the region, rolled out the innovative SafeCity Guarding initiative in 14 suburbs.

FleetDomain underpins Afrirent’s value proposition
Logistics (Industry) Security Services & Risk Management
Afrirent, a 100% female black-owned fleet management company, has been relying on FleetDomain software for a number of years to help it deliver outstanding service to a growing number of clients.

Choosing an inferior lithium battery can be detrimental and unsafe
Uniross Batteries Security Services & Risk Management Products
South Africans looking to mitigate the impact of load shedding by installing a solar system for their home must do so through an accredited installer or electrician to avoid insurance claims being rejected.

Employee screening, a hiring necessity or an invasion of privacy?
Security Services & Risk Management
There is a fine line between checking a potential employee’s qualifications and references, and investigating aspects of their lives that have nothing to do with their job application.

Keeping students, staff and communities safe
Vumacam News CCTV, Surveillance & Remote Monitoring Security Services & Risk Management
South African schools are facing increasing security challenges, making effective surveillance systems more important than ever. To address this issue, Vumacam is offering advanced security solutions with security partners, aimed at keeping students, staff, and the community safe.

Technology is key to securing physical and cybersecurity
Education (Industry) Security Services & Risk Management
The interpretation of security in educational institutions depends on whom you are talking to and whether their focus is on the physical security of the institution, its assets and its people, or its information and communication technology perspective.