Laptop Liabilities
By Frank Coggrave, UK Regional Director, Websense
Tuesday, 11 October 2005 13:03 EST
How many employees would dare to sit at their desk and use their PC to surf internet porn, download the latest number one hit from Kazaa or play an online game of poker? It is fair to say that probably not many (although you could argue that one instance is still too many).
But ask how many employees would perform these same activities in the comfort of their own home using their company laptop and the figure would rise sharply. In fact 42% of laptop users surveyed in the European ‘Laptop Liabilities’ research admitted that they had visited adult content, hacking sites and even worse peer-to-peer.
As with company cars and mobile phones, the distinction between who owns the item and who uses it has been eroded to the point at which employees regularly view a corporate laptop as their own property, to be used as they wish. This can be supported by the statistic that shows one in five have no idea who actually uses their laptop outside of work and for what purpose. Yet unlike a car or a phone, a company cannot keep a monthly track of how the laptop is being used, organisations are subsequently oblivious to the non-work activities until it is too late.
IT security would not be such a huge problem for IT managers if the corporate network was easily contained and protected. But the reality is that most organisations feature a growing band of workers that are no longer based in the office. Mobile working is on the increase, especially as more employers release the productivity benefits it brings. In 2002, the number of European mobile workers stood at 80.6 million and analyst group IDC anticipates that this will grow to 99.3 million by 2007.
Therefore, employers must broaden their IT security policy to take into account changing working practices and make sure that they have safeguards in place – such as an acceptable internet usage policy – to protect every corner of the company from emerging threats.
One of the key challenges for CIOs is raising awareness amongst workers of the dangers mobile working presents. According to the European Laptop research, 86% of corporate laptop users admitted to downloading software and other media, many of which violates copyright laws. Employees therefore need to be educated on the implications of their actions. Worryingly for IT managers, only one in ten expressed concern that their company could face prosecution for breach of copyright and only 15% of employees were worried about the potential risk of personal prosecution.
However such activities do not appear to be performed out of malice – it is fair to assume that in most cases, employees would use their own computer if they did not have a company laptop to hand. However the current level of ignorance surrounding security risks such as spyware (software that covertly gathers information about a user and transmits this to an unknown individual or third party) means that employees are putting their companies in a vulnerable position as well as risking their own confidential information.
Websense’s Laptop Liabilities research found that 93% of employees using laptops did not understand the threat of spyware despite the dangers it presents in recording keystrokes and password information. Most users confused the term with adware – non-malicious pop ups – therefore supporting the theory that laptop users are just simply naďve to the threats.
Clearly, many employees underestimate the damage their seemingly innocent Internet activities can incur. By accessing unprotected sites, the laptop user is actually helping the hacker spread malicious code – such as Trojan horses, viruses and spyware – across company servers when the laptop re-enters the server. The first indication an IT manager will usually receive that a laptop has been used for unauthorised activities is when malware or a virus infiltrates the IT infrastructure and starts infecting other machines. In the worst-case scenario, if spyware infects the network and there is nothing in place to detect and stop back-channel traffic – all manner of company and personal/ confidential information can be lost.
Employers therefore need to ensure that employees strictly adhere to any formal policies in place. The European Laptop Liabilities report found that half of these companies surveyed manage employees’ internet access on corporate laptops, but only a quarter enforce these polices physically and almost a third simply rely on employee compliance to written policies.
As the report revealed, ignorance is bliss for most employees. Whilst education is vital, automation is always the best option in ensuring safer surfing both in the office and at home. If most employees understood all the risks, they’d never want to proactively invite these unwanted visitors into their office or their home.
|
|
|
Latest News
eEye released integer overflow auditing tool
16.02.07 Vulnerability research company eEye Security has released a free security vulnerability auditing tool that helps spotting possible integer overflow vulnerabilities.
AES Password Manager 2.3 released
16.02.07 AES software has announced the availability of AES Password Manager 2,3, the latest version of their password management application that allows users automatically access password-protected web sites and email accounts.
IBM safeguards against Microsoft vulnerabilities
16.02.07 IBM’s security division, Internet Security Systems, offers protection from several critical vulnerabilities announced by Microsoft.
Firefox cookie-stealing vulnerability
15.02.07 A new zero-day vulnerability in Mozilla Firefox allows malicious web sites to forge authentication cookies for certain web sites.
Valentine’s Day: a powerful lure for spreading malware
09.02.07 As Valentine´s Day approaches, users should keep a wary eye on any romantic messages received by email, as many of them could contain malicious code.
Skype reads out your BIOS data
09.02.07 The Windows version of the Voice-over-IP software Skype reads and stores the BIOS and motherboard serial number of a user’s computer.
Utimaco SafeGuard Enterprise supports BitLocker
09.02.07 Utimaco has announced that its SafeGuard Enterprise now supports Windows Vista BitLocker drive encryption.
|
|
