Feel like you’re on a Merry-go-
round?

The Carousel Problem: Endless Access, Endless Risk

Feel like you’re on a Merry-go-round? I do. The security world has been spinning round and round, management giving users access of just about every sort then afterwards, trying to figure out how to minimize the risks of what they did. The past few years having been loads of fun and rather dramatic with regards to security & privacy,breaches, government monitoring/nation state spying as well as the likes of Edward Snowden, it just might be time to get off the horse and try another ride though. Quite a few years back, I remember vividly having charge of a rather large bundle of users on one of those new “computer networks.” It was a client server network with the server being a wonderful AT&T 3B2 Minicomputer that we rebooted every year whether it needed it or not. It was a 600 GR model if memory serves me correctly. Security concerns were growing daily with regard to our efforts at the time, a time when a degree in Communication or Computer Security was unheard of and even finding books to reference at the time took a bit of work. It was a good time to be in a growing field.

Now, I am not saying that the field is ceasing to grow, if anything it is still growing and too fast at that. What I am wondering however, is whether the idea that users should be allowed to access the Internet using employer owned resources, especially when we are talking about non work-related reasons such as checking the Craig’s List availability of some item, etc. will continue as it has all these years? Or will employers start to clamp down?

It is rather simple, at least in my mind, to justify a bit of a reduction in the free for all of technology access found in most companies-especially when we take a careful look at all the intellectual property theft, nation-state spying, etc. that is happening-not even mentioning the 10’s of millions of people whose lives are compromised on an increasingly more frequent basis as a result of card breaches of some sort-people like my neighbor who last week discovered someone already filed his tax return for him! The Telegraph had an interesting article recently on warnings for businesses that were coming from a joint report issued by GCHQ (The UK’s version of the NSA) and the UK Cabinet Office, Business Department and Centre for the Protection of National Infrastructure. The report had 10 warnings but what caught my eye was the oft repeated phrase, staff are the ‘weakest link in the security chain’ and could be blackmailed by enemy spies.
http://www.telegraph.co.uk/news/politics/conservative/11475583/Spooks-tells-business-
Consider-stripping-staff-of-smart-phones-to-avoid-cyber-attacks.html

The telegraph article says the report goes on to issue recommendations that include monitoring of staff, restricting use of removable or portable media and restricting or taking away some phone use, etc.

Staff as the Weakest Link — And Why It Still Hasn’t Changed

That staff are the weakest security link is no news to anyone even remotely associated with security-but this last bit is the part that has me smiling and wondering if we are back where we started, and whether or not it is time to exit the carousel where access is granted for every new technology or gadget one week and the next we try and figure out how to secure it. Will companies start restricting access to that which is required for performance of the job, requiring that company business be conducted using company controlled (and restricted) assets only? Will users be monitored? And punished as the GCHQ recommendations mention, if they fail to adhere to the rules? I wonder… Perhaps some of these employers with little appetite for risk, will shut down the carousel and move their staff on to something new.

The Coming Clampdown: Restricted Access and Culture Wars

I have recommended a more restrictive (by current standards) approach on several occasions over the past few years to clients but no one was willing to rock the boat. Recommending stripping away most Internet access at work is sure to win you a lot of friends but remember, security would not be the only one to benefit. Productivity would likely go up and costs would arguably go down (just think no more YouTube video streaming) Most studies show that employees spend 1-3 hours each day accessing the Internet for personal business/reasons. 1 hour a day, 5 hours a week, 20 hours a month. Any executive can put a number in dollars alongside that number. I wonder if the employees would be willing to take a 12.5 % pay cut to keep their access? Or be billed for access and lost productivity?

While there are quite a few benefits from a security and productivity perspective, there are of course drawbacks. The major one in my mind, assuming all legal questions are addressed, is the question of employee morale. No matter where everyone stands on the issue of access, no access, or limited access at work (and of course, associated controls and monitoring), one thing is sure-the question will always remain, so we should all start the discussions now. The solution will almost certainly not be the same for every company. Culture is one part of it, but risk appetite is another and appetites may change with leadership. I am “cautiously optimistic” that for the coming 12-18 months the discussions will continue and grow in this area