How to secure consumer gadgets in the workplace
The era when the IT department decided which laptops and phones workers would use in the office is ending: today employers are starting to embrace the idea that staff should be able to use their own laptops and smartphones in the workplace.
As many as a quarter of employers in the UK run bring-your-own computing schemes, where staff are given allowances or discounts to buy their own computers or phones to use in their day job, while employees in many other organisations will be using their own hardware to access work systems or store company data, whether the CIO likes it or not.
Allowing workers to use their personal devices at work has its risks, ranging from letting viruses and data-stealing trojans inside the corporate network to letting sensitive data out.
Dr Richard Clayton, security researcher at Cambridge University, warned that consumer tech poses a malware threat to businesses, as consumers are often less diligent than corporate IT managers at updating their antivirus suite and patching their software against the latest vulnerabilities.
“About one in 20 machines have something bad on them and almost none of their owners are aware that their machines are infected,” he said.
“In an organisation where all of the defences are around the edges of the corporation once you get a breach then the thing runs wild because there’s almost no protection inside.”
Bringing consumer machines into the workplace also increases the chance of corporate data loss – as staff carry sensitive corporate data around with them on their personal laptops and smartphones, theres an increased risk of that data falling into the wrong hands if the device is lost or stolen.
“If someone loses their laptop, an individual might just go and buy another one and not tell anyone, and the IT manager has no way of knowing that the data has been lost,” said Guy Bunker, security consultant and member of the security user group the Jericho Forum.
Once sensitive data is outside of the company firewall, the organisation has lost control of where that data might end up.
For example, today there are many services that allow consumers to back-up their data in the cloud – where data is copied to a third party’s datacentre and is accessible over the internet. If a member of staff backs up corporate data using a cloud service, the organisation’s IT department has no way of checking whether the third party can be trusted not to access or share that data. Fortunately none of the security issues surrounding the consumerisation of IT are insurmountable – an organisation can make consumer devices as secure as those bought in-house by putting the right security policies and technologies in place.
“The mantra is don’t do anything you wouldn’t do normally,” Bunker said. “Look at your audit and compliance and security and data loss prevention requirements and say ‘Can I make sure that the consumer devices will be as secure as if I own the hardware myself?’ “If you can’t guarantee that then think again – it doesn’t mean that you can’t do this because we know that some huge companies already do do consumerisation of IT. “It just means sitting back and thinking ‘I need to make sure that when they get their machines there’s a security stack on it which I can audit against’.”


September 3, 2010
|
Posted by Jit

Categories:










Recent Comments