Scott Wright’s Security Views

Just because the security budget doesn’t usually go toward things that earn the organization a visible return on investment doesn’t mean the security budgeting process should be pushed out of the way, and delegated down to each group for their own analysis. Here’s another way to look at security budgeting.

Suppose each child in your family received a set of collectible coins for their birthday. You tell them that the coins are special, and will someday be very valuable. They should take care of them. Each child does what they think is right. One puts it in a locked cabinet, another puts it into secret compartment under the back of their desk, and the other puts it high on a closet shelf. Continue Reading »

Here’s a simple poll for anyone who works in an organization that allows them to take work with them outside the office (i.e. home, laptop, kiosks, etc.), or to access it from outside (i.e. dial-up, VPN over the Internet, Wi-Fi hotspots, remote web access for e-mail, etc.).

Assuming you are allowed, or expected, to work with company information outside the office, we’re interested in knowing how well your organization guides you on reducing risk when handling corporate information outside the office. This could be things like:

1. Don’t install P2P software (Limewire, Kazaa, Morpheus, etc) on company laptops
2. Don’t leave laptops or media unattended or unlocked when travelling
3. Make sure anti-virus software is up to date
4. Don’t transfer files to unencrypted media
5. Don’t use company laptops for personal browsing to untrusted sites
6. Don’t check email from Wi-Fi hotspots
7. Don’t discuss business issues in public places

Facebook and other social networking sites such as Twitter are fast becoming a thorn in the side of security professionals. Management has quickly identified value in their ease of communicating and connecting with other colleages. However, they seem to have been a little slower on appreciating the risks involved to their organization in this type of activity.

Are we just being paranoid about the harvesting of information on these sites by hackers, spammers and social engineering fraudsters?

Take the poll, below, or view other polls by clicking HERE.

NOTE: I am trying a new survey mechanism to replace the previous one which did not work with this version of my Web server.

The following link goes to a Zap Survey poll that I have set up. Please follow the link and complete the poll. Zap Survey says they can not identify individual users. The technology is not under my control, so I can not vouch for what privacy provisions they may have in place.

I will post the results when I have a significant amount of data, or provide a link to the report page.