Scott Wright’s Security Views

With the growth in both occasional and full-time telecommuting, businesses are cutting corners to save costs, according to a recent Ernst & Young study. But the benefits to the organization may be outweighed by the risks if a few simple precautions aren’t taken. Despite the fact that some security professionals feel this is an “old news story”, I think it deserves more attention. These are still very important findings, especially in the context of managers who have finally been convinced that telecommuting can save the company some overhead, and (in some cases) improve employee morale and productivity.

Allowing employees to use their private home computers introduces many of the same types of risks as opening up the corporate firewalls. There is the very real potential of opening up big holes in the enterprise network that attackers can find irresistable.

Here are five ways you can make your telecommuting program more secure: Continue Reading »

In the same vein as spammers who depend on your clicking on or replying to their messages to feed their voracious appetites for valid email addresses and traffic, you should be aware of a fast-growing, yet less obvious risk.

With the growth in small, low-cost, high capacity Mobile Storage Devices (e.g. USB Drives, MP3 Players, Cameras, PDAs), it is inevitable that the things will get lost. So, when you see one abandoned at a phone booth, on a bench or in a hallway, the scenario may seem harmless enough — a memory stick fell out of a pocket, or was left there by accident. But at the risk of sounding paranoid, don’t do the obvious. Continue Reading »

Here’s a simple poll for anyone who works in an organization that allows them to take work with them outside the office (i.e. home, laptop, kiosks, etc.), or to access it from outside (i.e. dial-up, VPN over the Internet, Wi-Fi hotspots, remote web access for e-mail, etc.).

Assuming you are allowed, or expected, to work with company information outside the office, we’re interested in knowing how well your organization guides you on reducing risk when handling corporate information outside the office. This could be things like:

1. Don’t install P2P software (Limewire, Kazaa, Morpheus, etc) on company laptops
2. Don’t leave laptops or media unattended or unlocked when travelling
3. Make sure anti-virus software is up to date
4. Don’t transfer files to unencrypted media
5. Don’t use company laptops for personal browsing to untrusted sites
6. Don’t check email from Wi-Fi hotspots
7. Don’t discuss business issues in public places

It’s almost like you can’t trust people these days. You’d think if someone broke into a house looking for valuables they’d at least leave the “work” stuff alone. But NO, the thieves have to go for the laptop, without any regard for how much “sensitive information” might be on it. No regard for the red tape it will put you through when it goes missing. The nerve! Why couldn’t they have just taken the kids’ iPod? It’s worth almost as much…

Folks, it’s all just becoming a bit too much for me, these breaches that could easily have been prevented. This one happened a bit closer to home for me (click HERE). Continue Reading »

You can view the archive of “The Practical Security News” and sign up for the automated e-mail distribution list by clicking HERE.

IN THIS ISSUE

1) For Executives -

What do you mean “Table Stakes”… I just want to do BUSINESS!

Even people with the best of intentions can be fooled by SPAM e-mails, browser pop-ups or dialogs that try to scare them into doing something you wouldn’t otherwise do on the Internet.

This article in CNET’s “Spyware Horror Stories” series (click HERE) is an example of something that probably happens to a lot of people, and they don’t even know it.

Continue Reading »

It’s easy to get caught up in the excitement of an industry conference. Salespeople and Executives are often quite accustomed to the hyped-up environment of trade shows. But as an employee, there’s a good chance you don’t go to more than one trade show a year.

So, it can be a big break from your daily routine. Whether it is a “more” stressful or “less” stressful break depends on your job. But this is not an excuse to let down your guard when it comes to information protection.

Continue Reading »