ComputerWorld’s “8 Most Dangerous Consumer Technologies”
In a world of runaway consumer technology, an article proclaiming to name the 8 “Most Dangerous” items among them may seem … alarmist? Sensationalistic?
Be that as it may, when viewed from a business owner or manager’s perspective, the threats posed by everyday (and seemingly harmless) consumer technologies are signifcant. From security breaches to stolen information, many of these technologies are risky by their very nature (info storing and transfer; ease of photography).
With that in mind, we bring you ComputerWorld’s list of “8 Most Dangerous Consumer Technologies.” The run-down:
1. Instant messaging
… Instant messaging present numerous security challenges. Among other things, malware can enter a corporate network through external IM clients and IM users can send sensitive company data across insecure networks.
Among ComputerWorld’s suggested solutions is to “phase out consumer IM services and use an internal IM server.”
2. Web mail
… The problem with consumer e-mail services such as those from Google, Microsoft, AOL and Yahoo is that the users themselves don’t realize how insecure their e-mail exchanges are because messages are transported over the Web and stored on the ISP’s server as well as the e-mail provider’s server. Without that awareness, many use no discretion about sending sensitive information such as Social Security numbers, passwords, confidential business data or trade secrets.
ComputerWorld suggests working to eliminate these security risks by using a “tool that monitors e-mail content using keyword filters and other detection techniques and the either generates alerts regarding potential breaches or simply blocks the e-mail from being sent. For instance, WebEx Communications is considering expanding its use of a data loss prevention tool from Reconnex Inc. to include e-mail monitoring, according to Michael Machado, director of IT infrastructure.”
3. Portable storage devices
One of an IT manager’s biggest fears … is the steady proliferation in types of portable storage, ranging from Apple iPhones and iPods to flash memory devices. “People can use these to download any number of corporate secrets or sensitive information and move it off-site, which is not where IT wants that information to be.”
Locking down employees’ USB ports is not the solution, the article states. Instead, “handle the matter by educating people on how to treat the storage of sensitive information.”
4. PDAs and smart phones
More and more employees are showing up at work with some form of smart phone or personal digital assistant, be it a BlackBerry, a Treo or an iPhone. But when they try to synch up their device’s calendar or e-mail application with their own PC, it can cause problems ranging from application glitches to the blue screen of death.
… Moreover, should the employee quit or be fired, he can walk out the door with any information he wants, as long as the PDA or smart phone belongs to him.
The suggested solution here is the use of WebEx, which “minimizes those possibilities by standardizing on a single brand and model of PDA and letting employees know the IT organization will only support that one device.”
5. Camera phones
A hospital worker stands at a nursing station, casually chatting with the nurses. No one notices she’s got a small device in her hand, on which, from time to time, she’s pressing a small button. A scene from the latest spy thriller? No, a security test conducted by DeKalb’s Finney.
“One of the tests I did was to go to take my cell phone to the nursing station and start clicking off photos, unbeknownst to them,” she says. “I wanted to download the photos, enhance the images and see what I got — patient information displayed on computer screens or on papers lying on the desk.”
Again, the suggested solution is to educate people about the dangers, which often are unrealized by the very people in the position to abuse them.
6. Skype and other consumer VoIP services
Another fast-growing consumer technology is Skype, a downloadable software-based service that allows users to make free Internet phone calls. … In a business setting, the threat presented by Skype and similar services is the same as that of any consumer software downloaded to a corporate PC.
… The most secure option, and one that research firm Gartner Inc. recommends, is to block Skype traffic altogether. If a business chooses not to do that, it should actively engage in version control of Skype clients using configuration management tools and ensure that it is distributed only to authorized users.
7. Downloadable widgets
According to Yankee Group, consumers are using devices such as the Q and the Nokia E62 to download widgets that give them quick access to Web applications. These widgets can be easily moved to PCs, which … represent another entry point into the technology ecosystem that IT struggles to control.
The risk here is that these tiny programs use processing power on the PC and the network. And beyond that, any software that gets downloaded without being vetted represents a potential threat.
Once more, the suggested solution involves WebEx, which “mitigates this risk using a threefold approach. It educates users on the risks of software downloads; it uses Reconnex to monitor what’s installed on user PCs; and it disables some of the users’ default access rights, restricting their download capabilities.”
8. Virtual worlds
Business users are beginning to experiment with virtual worlds such as Second Life, and as they do, IT needs to become more aware of the accompanying security concerns.
… Using Second Life involves downloading a large amount of executable code and putting it inside the corporate firewall. … In addition, there’s really no way to know the actual identities of the avatars who populate the virtual world.
The article offers a possible way around this dilemma: “One option … is enabling employees to access their virtual worlds over the company’s public wireless network or encourage them to do it from home. A third option is for companies to evaluate tools to create their own virtual environments that would be hosted internally within the enterprise firewall.”
Check out the original article, written by ComputerWorld.com’s Mary Brandel, here.
