Google revealed yesterday a targeted phishing attack from China against hundreds of GMail users, including government officials and military personnel.  The FBI, Department of Homeland Security, and the White House National Security Council are all participating in an investigation of the cyber attack.

My hope is that this breach will serve as the wake up call that public and private businesses need to start enforcing policies around personal email.  According to an Ipswitch survey at the InfoSec Europe conference, employee use of personal email is still a major problem.  Nearly 70% of respondents send classified information (including payroll and customer info) via standard email every month… And 40% admitted to sending confidential information through personal email accounts specifically to eliminate the trail of what was being sent to whom.

Have you provided your employees with a simple tool to send large and confidential files?  Do you have visibility into what is being sent and to whom??  Do you have a documented AND enforced policy around using personal webmail accounts from work computers???

Employees have proven over and over that they will ‘do what they need to do’ in order to be productive. It’s critical that organizations provide simple, safe and auditable tools that enable employees to collaborate and share files.  It’s equally important that they govern employee activities to mitigate data risk by increasing visibility, control, compliance and security.

Ipswitch’s Frank Kenney shares his perspective on breach responsibility and security with Information Week:

“Google has asked for U.S. government support against censorship, but the government’s response has been to ask companies to take responsibility.  If Google does have an ulterior motive, it’s likely to be to pressure the U.S. government to take a more active role in defending U.S. companies in markets like China that present obstacles to fair competition.

Google is urging Gmail users to review their account settings to make sure they’re secure, but Kenney suggested Google could do more to alert users when their accounts are accessed from an unfamiliar IP address or when their accounts have been configured to forward messages.”