Locking down to open up – taking control of the enemy within
Locking down to open up – taking control of the enemy within
IT security tools have traditionally focused on preventing what we could loosely call “the external threat” – hackers, viruses, worms and so on. From the perspective of customer organisations however, this is only one part of the story. It is just as likely, for example, that an attack would come from an insider, a lowly clerk or disgruntled programmer having a quick browse round the HR file share to see if there’s any interesting files left visible. We know this is the case – when we spoke to 715 senior IT managers in October last year (“Enabling the trusted workforce”), they told us that inside jobs were almost as likely as indiscriminate pestering (viruses etc) and even more likely than targeted attacks from the outside.
While this may come as no surprise to the reader (who probably works for such an organisation, and who may well have experienced such incidents), it does beg the question why this has been less than attended to, in the past. We discussed this here (link to prev article), and noted that IT vendors are waking up to the issues and indeed doing something about them.
Employee-related risk is a moving target, however. The fragmentation of corporate systems makes it harder to keep control of confidential data, an issue exacerbated by the availability of portable storage such as USB sticks and MP3 players. Of course, it is possible to prevent such devices from being connected to corporate equipment, but that creates problems of its own – USB sticks sometimes offer the only way to get a file from A to B (say, from one person’s desktop to their laptop, in the absence of network connectivity); furthermore, actively switching off USB ports is an operational nightmare and is difficult to do without blocking access to other, perfectly valid devices (printers, say).
As new generations of IT offer new ways of working, they also create new security headaches: consider mobile devices such as the Blackberry, which may be a powerful asset but equally, can be easy to leave around. IT is unsurprising perhaps, that security technologies seem to be forever in catch-up. Equally clearly, the problem can never be solved by technology alone – even the most secure environment needs to be managed by somebody, who may or may not have their own fingers in the pie.
Put bluntly, few organisations are doing everything they could to ensure that the IT risks associated with their own staff are minimised. This is as much about procedure and policy as it is about technology. Only about a third of enterprise organisations actively screen their own staff as part of the recruitment process of example, and this number drops still further for smaller organisations. We’re not advocating a police state – the goal is understanding and management of the real risks, rather than trying to create jobs or undermine the rights of employees. However, one wonders if technology is sometimes being used as an avoidance tactic, as it is easier to go through the motions of locking down systems than it is to ask hard questions of one’s peers and direct reports. This is reflected in the research, as nearly 70% of respondents commented that policy and process related challenges were holding them back.
This is an important point, as the upshot of all of this is less to do with ending up with a nicely secure organisation – security cannot be an end in itself. Rather, it is more about reducing risk to the extent that the organisation feels comfortable to push its own boundaries, into domains such as remote working, better use of mobile devices, closer relationships with suppliers and so on. It is perhaps overstating things to say that security is an enabler; however few deny that concerns surrounding security are preventing organisations from moving in such directions. It is not ironic that those companies that seem to lock things down, are actually those who are better placed to open themselves up to new opportunities. In a world in which business agility, the ability to move with the times is becoming ever more important, that’s a fact worth remembering.