Management > Security

'People' issues in IT security

Cath Everett Published 21 June 2011

Round table: 'People' issues in IT security

Converged networks and the spread of mobile devices are posing new challenges in protecting digital information

While it may be people who cause the greatest information security headaches, they also hold the keys to getting it right.

A round table discussion, sponsored by network security specialist Fortinet at the recent Public Sector IT Leadership Forum, highlighted that while errant human behaviour poses the biggest threat to keeping corporate data safe, finding ways to educate users on how to handle it properly will go a long way towards ensuring its security.

As one attendee pointed out: "It's about educating users to do the right thing rather than just locking everything down. So it's about getting people to take ownership."

Another said it is vital to help users understand the risks. To illustrate the point, he cited the example of asking to 'friend' his two children on the Facebook social networking site using a pseudonym - an approach that both accepted. After subsequently casually mentioning that he was aware of this conversation or that activity, however, he said that finally "the penny dropped".

"It was a useful tool to understand their life, but also help them understand that they had to be a lot more careful about what they were doing on Facebook," the participant said.

A further consideration when trying to modify employee behaviour, however, is coming up with an acceptable or as one roundtable member put it 'responsible' use policy in order to provide staff with guidance as to what they should and should not be doing with the technology available to them.

But as one delegate warned: "ICT security policies are a moving target at the moment, especially with things like social networking. So it's comes back to saying 'As staff, you are responsible' and drumming the message home, although it's not always easy to get it across."

But social networks and the security risks they pose in terms of malware infection and/or data leakage are not the only challenge facing IT departments. Another big one is also the growing consumerisation of technology and that fact that more and more workers are pushing to use their own uncontrolled and inherently insecure gadgets to access the corporate network.

As a result, now more than ever, the ongoing challenge for IT professionals is to find the right balance between empowering staff to take advantage of the latest technology and ensuring that sensitive corporate data is not laid wide open to danger.

But another round table member said technology has an important role to play in helping to tackle this situation. In his view: "The key is working with consumers on acceptable use and also helping them to work in a controlled environment."

An example of this theory in practice can be illustrated by an organisation that has created a secure portal through which employees access corporate applications and data using a virtual private network and two-factor authentication technology.

Access to this secure portal is obtained via an untrusted wireless network that is also used by visitors and home or remote workers and which has replaced an assortment of protected and unprotected ones.

Because a raft of corporate applications and data have been centralised to run on back end servers, however, they can be accessed remotely from any client device rather than needing to be downloaded locally. This means that there is no need to worry about the information security ramifications of staff using their own gadgets at work or of them being lost or stolen as they store nothing of value.

The organisation's head of IT said: "The idea is to allow all kinds of devices onto the network, which is going to be a big thing over the next two years. So we can say to staff 'You can bring in your own device', which will save us money. But also from an information assurance point of view, we can be confident that data isn't going out of the data centre."

One delegate warned that it was necessary to recognise that, even in this scenario, client devices still pose a threat. Because it is possible to download applications onto devices such as smartphones and PDAs, there is a danger that they could become infected by malware.

As a result, he said: "You have to look not just at network authentication, but at the reputation of the client device, rather than its owner. This means that IT has to be aware of what the device is doing on the network so that action can be taken to block it if they notice it's started accessing loads of suspect websites, for example."

While converged network security appliances can help in this context, again people issues can make adoption a somewhat tricky proposition. Although security roles have traditionally been splintered between a number of IT personnel, converged devices require a similar convergence of accountability.

As the delegate concluded: "Although the technology may be converged, the problem is that organisations often aren't. But the combined nature of threats today means that technology fiefdoms no longer work, so it's about ensuring that an individual is appointed to take the necessary responsibility."








We have updated our privacy policy. In the latest update it explains what cookies are and how we use them on our site. To learn more about cookies and their benefits, please view our privacy policy. Please be aware that parts of this site will not function correctly if you disable cookies. By continuing to use this site, you consent to our use of cookies in accordance with our privacy policy unless you have disabled them.