Access Control (AC) aims at restricting access to resources. Traditionally, Access Control can be divided in two categories: Discretionary Access Control (DAC) (Lampson, 1974; Saltzer and Schroeder, 1975; Harrison et al., 1976) and Mandatory Access Control (MAC) (Bell and LaPadula, 1973; Biba, 1977). In DAC models, users can set, modify or share the access control of their resources. Most modern operating systems such as Windows, GNU/Linux and Mac OS are based on DAC models. On the contrary, MAC refers to a family of models where owners do not have to choose the rights over their resources. In this type of access control, the system assigns security labels or classifications to resources (for instance “classified,” “secret,” or “top secret”) and allows access to subjects or applications depending on their level of clearance. Over the last decades, several models have been proposed to cover the problem of Access Control. These models propose to take into account various notions, including roles (RBAC) (Sandhu, 1996), attributes (ABAC) (Hu, 2013), context (Corrad, 2004), history (Banerjee and Naumann, 2004), risk (Kandala et al., 2011), authorization (Karp et al., 2010) or trust (Kagal et al., 2001).

In Shabtai et al., 2012, a DLP has been described as a “system that monitors and enforces policies on fingerprinted data that are at rest (i.e., in storage), in-motion (i.e., across a network) or in-use (i.e., during an operation) on public or private computer/network.” DLPs are usually based on policies. These policies can help security experts and administrators to prevent data leakage by defining rules such as “send an email when user U1 sends document X to user U2.” Since 2006, several larger vendors have bought smaller companies specialized in data security. ^b Thanks to these buyouts, DLPs technologies have started to arise since 2008, proposing scalable and business oriented solutions. Nowadays, the biggest vendors are Websense, ^c Trend Micro, ^d RSA, ^e Symantec ^f and Palisade Systems. ^g

From the academic point of view, researchers have focused on several problems, including emails leakage protection (Zilberman et al., 2011), network and Web based protection (Caputo et al., 2009) and misuse detection in database (Harel et al., 2010; Harel et al., 2012). Moreover, solutions have been proposed to improve detection methods by using machine learning (Gafny et al., 2010; Mathew et al., 2010; Li et al., 2015). Closer to industrial preoccupations (Alawneh and Abbadi, 2008), have proposed a framework to protect the data shared between collaborative organizations. Finally, some works have been proposed to tackle sensitive data (Chae et al., 2015) or confidentiality (di Vimercati, 2011).

IRM is a subset of Digital Rights Management (DRM). A DRM is a mechanism that aims at preventing unauthorized redistribution of a digital media (e.g., document, music, video) and restricts the ways consumers can use this content (copy, distribution to others, etc.). DRM solutions have been developed in response to the increase of online piracy (i.e., redistribution of copyrighted information over the Internet thanks to peer-to-peer networks). Within companies, IRM [Other names, such as Enterprise DRM, can also be found in the research field] can be used. IRM refers to Rights Management technology specifically designed for enterprise documents. Thus, IRM aims at protecting sensitive information, such as patents, employees personal information or financial data.

The main vendors in the domain are Seclore, ^h Microsoft, ⁱ Covertix, ^j and EMC. ^k From the academic point of view, traditional DRM have been discussed in many papers (Rosenblatt et al., 2001; Subramanya and Yi, 2006; Van Tassel, 2006). Different IRM solutions have also been proposed and compared (van Beek, 2007), especially to tackle problems such as insiders leak (Yu and Chiueh, 2004), usage tracking (Yang et al., 2013) and storage efficiency issues (Soliman et al., 2015).

Many surveys on security and usability have been proposed over the years. For instance, specific types of users, such as administrators or security experts have been targeted by surveys such as CryptzoneSurvey. ^l In this survey, administrators have been asked to give insights on the usage of network Access Control technologies and best practices. In SANS survey, ^m security experts have been solicited to have insights on end-users security behavior. Closely to end-users themselves, security and usability have been studied in many ways, covering fields such as privacy (Kumaraguru and Cranor, 2005) and behavior (Beautement et al., 2016). Moreover, studies have been conducted to determine the perception of security properties such as confidentiality (Bai et al., 2016; Ruoti et al., 2016) and authentication (Stobert and Biddle, 2014) while other works have proposed mechanisms such as recommendation systems (Liu et al., 2016) and indicators (Felt et al., 2016) to help the end-users.

Finally, other works have been proposed in the DLP field to take into account usability. For instance (Ko et al., 2014), have proposed a user-centric mantrap-inspired DLP solution, implemented in Debian Linux to inform end-users about potential data leak and allow them to fully decide sending or not the data. In addition, DLP vendors such as Clearswift ⁿ and Teramind ^o propose adaptive dashboards and reporting in order to make their products more usable and user-friendly. However, to the best of our knowledge, no survey has been proposed to specifically target the end-users perception toward data leakage within companies. Thus, we aim at gathering information on this topic by proposing an online survey. This survey is described in the next section.

The question 1 (What is the sector of your company?) of the survey is related to the sector the participants are working in Figure 1 shows various results due to the fact that different mediums have been used to share the survey. Thus, various sectors are represented, such as IT (28%), business/transport/hotel/food/catering (13.3%), housing (12%) or Insurance/banking/financial institution (8.6%). Other fields, such as defense (2%) construction (1.3%) or energy (0.6%) are anecdotal.

Thanks to the question 2 (What is the size of your company?), we have underlined that all sizes of companies are also represented. Indeed, results in Figure 2 show that roughly 52% (30.6 + 21.3) of the participants work in companies that employ less than 250 employees. Moreover, results show that big companies (i.e., strictly more than 5,000 employees) are also well represented (29.3%).

Thanks to the question 3 (What is your position?), the survey shows various results regarding the position of the participants. Indeed, Table 3 shows a snippet of the results we have obtained. As one can see, various profiles can be underlined, including technical positions such as IT engineers, administrators, developers and security experts. Moreover, other profiles can be highlighted, such as accountant, bankers, Ph.D. students/researchers and employees from human resources. Finally, other types of participants have also answered the survey, including librarians, CEOs, professional photographs and building architects.

The results of the question 4 (How would you rate your computer skills?) depicted in Figure 3 underline that the level of knowledge and skill is a very subjective and personal perception. For instance, some accountants have set a very high score (6 out of 7) while some IT professionals have set a smaller level for their own skills. Nevertheless, it is safe to state that whatever the position, most participants consider that they know some things on computers.

Generally, there is no correlation between the perceived computer skill and the position except for the participants who have a very high skill level (7) where 60% of the participants have a technical profile in Information and Communication Technology (developer, IT support, architect, team leader, engineer, etc.). However, we noticed that there is a correlation between the perceived skill and the size of the company. The skill increases slightly with the size of the company as we can see it in the table below.

Now that we have described the results concerning the context and employees, we describe in the next subsection the questions and results that target employees’ awareness, knowledge and perception on security policies and data leakage.

Thanks to questions 5 (In your work, do you have to manage sensitive data?) and 6 (If so, do you often manipulate such data?), we have noticed that 88.7% of participants manipulates sensitive data. We underline that the survey gives a definition of what a sensitive data is, in order to reduce biais induced by participant’s own definition. While filling the form, we present the following definition for sensitive data: “By sensitive data, we mean data containing confidential information that needs to be kept between a restricted set of users (patent, accounting, personal information, etc.).”

Concerning the occurrences, we have seen that 41.1% of participants manage sensitive data frequently (“A significant part of my work is to manipulate sensitive data.”), as against 19.2% who have declared that manipulating such data is rare (“It is never common in my work to manipulate sensitive data.”). Finally, 40% of participants have declared that they manage sensitive data in a quite regular basis (“From time to time, I have to manipulate sensitive data.”).

We can conclude that many employees have to deal with sensitive data (e.g., patent, accounting, personal information) while performing their day to day tasks.

The results obtained showed no correlation between the usage of sensitive data and the size of the company/activity sector or the position of the participants.

The next question (i.e., question 7: In your company, are you aware of the security policies that concern you?) we have asked to the participants refers to their knowledge regarding security policies within the company. Results shows that 69.5% of them are aware of the security policies and know what they can/cannot do in terms of security (i.e., Access and Transmission Control). However, we underline that roughly a quarter of them (23.8%) have declared that they do not really know what they can/cannot do, despite the fact that they are aware that some security policies exist. Finally, only 6.7% of the participants have declared that they are not aware of any security policies within their company. Based on these results, we can conclude that most participants have some knowledge on the security policies applied within their companies.

The results obtained showed no correlation between awareness regarding security policies and the size of the company/activity sector or the position of the participants.

Another question that we have asked is about bypassing security policies (i.e., question 8: If you are aware of such policies, have you ever done anything to bypass them?). Results show that 43.7% of the participants have bypassed a security policy without knowing it, causing a potential unintentional data leakage. Moreover, results show that 35.1% have declared that they have never bypassed a policy, while 21.2% have declared that they have bypassed a policy intentionally.

While exchanging with the 10 participants who gave their email address, we have discovered that some unintentional bypasses have been performed for the following reasons (words in italic are words that have been used by the participants):

Lack of awareness: security policies are not well specified or too obscure for the employees, preventing them to specifically know “what can be done with the document.”

The results obtained showed no correlation between the fact to bypass security policies and the size of the company/activity sector or the position/computer skill of the participants. However, concerning, the 65 participants who have answered that they have bypassed the security policies, their response regarding the question 7: “In your company, are you aware of the security policies that concern you?” was as follow:

“No, and I do not know if they exist” for six of them;

Based on the previous declarations, we have asked participants their feelings on the lack of awareness and knowledge regarding the security policies of the company. Results of the question 9 (Do you think that not being aware of such policies is an obstacle for your work?) show that 61.6% have declared that not knowing the policies is an obstacle for their tasks (while only 17.2% have declared that it is not an obstacle at all). Thus, we can say that the lack of knowledge regarding the security policies can increase the difficulty of performing some tasks, like editing and sending documents such as patent, photos, reports or accounting files.

The results obtained showed no correlation between the feelings toward the lack of awareness and knowledge regarding security policies and the size of the company/activity sector or the position of the participants.

In this Section, we present the results of the question 10 According to you, data leakage can be:

A problem for the company (financial loss, image, etc.),

The results show that most of the participants (71.5%) are aware that a data leak can be a very big problem for both companies and employees. Moreover, 23.2% of them have declared that only companies are impacted after a data leakage. Finally, the other choices (i.e., “a problem for the employee” and “a problem for neither of them”) are anecdotal (respectively 4.6 and 0.7%). Thus, we can conclude that most participants are aware that data leakage can be a problem for both companies and employees independently from the size of the company/activity sector and their position.

Concerning the mechanisms to tackle the problem of data leakage, the results of the question 11 (Are you aware of security mechanisms implemented within your company?) show that 55% of participants have declared being aware that their company uses some kind of data leak prevention mechanisms. According to the 13 participants who have commented the form (thanks to the last question, i.e., question 16: If you have any ideas of mechanisms, some remarks or comments‥.), we can state that these mechanisms embed network filtering, document ciphering, Document Management System (DMS) and DLP (Symantec). However, no IRM mechanism has been cited yet.

Most of the 13 participants, who have provided comments about the security mechanisms, have a technical profile (i.e., computer skills) and work for large companies in high tech domain (see Tables 5–7).

Concerning the other results, the survey shows that 21.2% of participants are not aware of security mechanisms within their company (as against 23.8% who have declared that such mechanism exists within their company, without having explicit knowledge of it).

The results obtained showed a correlation between awareness and knowledge regarding data leak prevention mechanisms and the size of the company. This is discussed in “Discussion.”

Answers gathered thanks to questions 12 (Do you think that these mechanisms are an obstacle to your work?) and 13 (Do you think that these mechanisms are intrusive for employees?) show interesting results regarding the perception of data leak prevention mechanisms (see Table 8). On one hand, we can underline that for a non-negligible part of participants, these mechanisms are quite blocking. Indeed, if we consider levels 4 and 5, these mechanisms are quite constraining for 44% of participants. However, roughly a quarter of the participants (31.1%) considered that these mechanisms are not very constraining.

Concerning the intrusiveness, Table 9 shows that roughly 44% of participants think that these mechanisms are intrusive, while 31% have declared that it is not the case. Thus, we can conclude that the perception of constraint and intrusiveness varies from one individual (and context) to another. However, it is safe to state that these mechanisms are not imperceptible by most employees.

The results obtained showed no correlation between the perception and feelings of the participants regarding data leak prevention mechanisms and the size of the company/activity sector or the position of the participants.

The goal of the question 14 (see below) was to collect information about the preferences of the participants regarding anti-data leak mechanisms in terms of non-intrusiveness, ease-of use and efficiency.

Question 14: According to you, what are the most efficient mechanisms to avoid data leakage?

Notify users that an action is going to cause a data leakage and let her/him choose (e.g., popup messages).

The obtained results to this question are presented in Table 10.

Moreover, we underline that an open question (i.e., the last Radio button: Other form of mechanisms) has been proposed to allow the participants to cite other mechanisms. Among the obtained results, we can cite:

Use a Public Key Infrastructure.

As we can see in Table 5, most of the participants would like to be notified that an action is going to cause a data leakage. 45% of the participants prefer to decide to continue or not the action they are performing. 56% of the participants prefer to not take any responsibility and leave the decision to the administrator/manager to prevent or not an action. However, 9% of the participants want to be considered and informed if an action is prevented. 69% are in favor of automatic actions (i.e., automatically prevent/deactivate action).

The goal of the question 15 was to ask the participants if they would prefer a mechanism that let them decide, but might let them perform a data leakage (more “freedom”), or if they would prefer a mechanism that prevent them to perform unintentional data leakage, without letting them decide (more security). Results show that more than 55% of them prefer security over freedom, whatever the type of participants (i.e., positions and skills). However, we have discovered interesting correlation with the size of the companies. These correlations are presented in the next subsection.

By comparing the size of the companies and the previous question (i.e., question 15: In the end, you would prefer a mechanism that let you decide, but might let you perform data leakage or a mechanism that prevent you from unintentional data leakage, but does not let you decide), we have discovered that participants from very small companies tend to prefer a mechanism that promotes security over a certain freedom.

Indeed, Table 11 shows that, in the case of middle-sized, big, and very big companies, the ratio between answers are quite equivalent. In the case of very small companies, the distribution is very different, underlining that employees of these companies rather prefer a mechanism that prevent them to leak data, even if this mechanism is too restrictive. In order to have a better understanding of these results, we have asked some participants, in small companies, to explain their choice. Among the answers, we can highlight the following remarks (the words in italic are the ones used by the participants):

“The data are my bread and butter, I cannot lose them over a mistake.” (Entrepreneur).

These answers show that a smaller infrastructure tends to make the leaker “more responsible,” probably because of the social proximity with the other employees.

As a conclusion, we can say that the smaller the company, the bigger the need for security. Employees of bigger companies prefer having more freedom over security.

When analyzing the results obtained for the question 11 (Are you aware of security mechanisms* implemented within your company?), we have noticed that there is a correlation between awareness of the participants toward the security mechanisms and the size of the company (see Table 12 ). Indeed, participants from bigger infrastructures tend to have a better awareness and knowledge of the security mechanisms used by their company. We hypothesize that bigger infrastructures are more likely to inform, raise the awareness and educate the employees, thanks to dedicated guidelines and training.