All the latest UK technology news, reviews and analysis
|
|
|
15 Jun 2007
One of the most significant and growing threats to enterprise security is the 'consumerisation' of IT, and security managers must prepare to meet the risks as more consumer technologies enter the enterprise.
The warning comes from industry analyst Gartner which envisions that, as employees expect to use more personal equipment and services at work, enterprises are simultaneously adopting more consumer technologies in business operations.
"Although consumer technologies create new risks for the enterprise, eliminating their use is increasingly difficult and impractical," said Rich Mogull, a research vice president at Gartner.
"By taking security precautions and investing in foundational security technologies now, enterprises can prepare for the increasing use of consumer devices, services and networks with their organisation and manage these risks."
Tools exist to manage the risks of consumerisation, the analyst said, and many of these, such as Network Access Control or Content Management Framework/Data Link Protocol (CMF/DLP), are being adopted by enterprises to manage other threats and can be configured for consumerisation threats.
While in some cases it may be too early or costly to invest in less mature tools, enterprises can start with policies and procedures to help guide future technology deployments.
Gartner has identified four consumerisation issues for which IT managers must prepare:
"Most organisations will find themselves unable to completely block these services for cultural, if not technical, reasons but security options are available to limit the risks that consumer communications services create," said Mogull.
"Enterprises can look at vectors for malicious software or violations of corporate communications policies.
"Current acceptable use policies often do not cover these areas, and traditional email security or firewalls and URL filtering do not deal with them effectively."
Gartner advises enterprises to define clear policies about what is, and what is not, allowed with regard to these services.
Enterprises should also configure web security gateways to block any services unapproved for use in the workplace, and configure CMF/DLP solutions to monitor and enforce policies on HTTP traffic.
Latest stories from Security
Related videos
Related articles
Related jobs
Poll
Are you confident that the UK's IT infrastructure is secure from attack in the wake of the Flame malware revelations?
TFL director of Games transport Mark Evers discusses how the public transport network is preparing for this summer's event
Connect with V3.co.uk
The wrong printers, for the wrong tasks on the wrong contracts
Who leads the BI pack and who should we be watching out for?
Security Assurance Consultant ( CLAS ) with HMG and Information...
Solutions Design Architect - Oracle - Exadata - Dataguard...
My Client is a tier one investment bank based in Edinbugh...
Analyst Programmer Web Developer required to work for...
Keep up to date with the latest products, services and technologies from the world's leading IT companies. IThound.com brings you over 2,000 white papers, case studies and analyst reports.
Do you agree?
Dodge the consumerisation bullet or bite it!
Consumerisation is a matrix that has crept up on us and effectivly has us all. People more and more want what they want, where they want it and how it is provided. Consumerisation seems an obvious step for most business environments. We have already seen the effects from insant messaging demands, skype calling and itunes in the office. The evolution of business mobile devices has gone from the functional LCD phones, to the full colour screen, stylised devices with cameras, radios and media players. Case in point, the evolution of the blackberry has no doubt been driven by end user demands. Is an integrated camera, as seen the recent designs, an essential blackberry tool for the corporate worker? All these new technologies must be supported, as if the IT staff were not busy enough. More importantly, the business network requires defending. As with AOL IM virus (http://www.vnunet.com/vnunet/news/2145038/aol-hit-im-virus) a new technology can open the network to further risks. As Rich Mogull, a research vice president at Gartner said "Although consumer technologies create new risks for the enterprise, eliminating their use is increasingly difficult and impractical". The next step always seem to be buy in and integrate more counter measures. At what cost of time and effort and not forgetting capital. The overall result is the network becomes more complex. Firewalls more porous. System interrelations become more and more fragile. Plus what policies do we implement? Who do we apply them to? Who is going to pull rank to be an exception?! Wouldn't it be nice not to burden ourselves and our stretched IT resources with any remote access device that connects to the corporate network? Give users freedom to have machines exactly how they want them, and for us not to have to worry! How much more secure would a network be if no users logged in there? There is a new product available today that allows nodeless application VPN with strong 2 factor authentication in built. What does this mean? The 'specifically authorised' client machine does not become part of the network. Only the known is let in, the rest is ignored. The application's process is locked to the encrypted tunnel. Splitting DNS means all comms use the loopback address. Unlike SSL VPN application don't have to be webenabled. The menus do not allow the client to browse the network. Place all this in a runable (no need to install) format and the whole system could and does run from a USB key. No need to have ownership or to any major degree control the client machine. Only authorised applications gain access, users can use whatever else they like. The product is called G/On more information go to www.giritech.com
Posted by: Ron Wilkins 18 Jun 2007