Feeds

Users: The weakest link in laptop security

Is end user training still an optional luxury?

Providing a secure and efficient Helpdesk

Reg Tech Panel If you ask the average business person who is responsible for the security of data held in computer systems, the chances are they will point to the IT department. After all, it's all about passwords, keys, firewalls, locks on computer room doors and other systems-related perceptions they have picked up without ever really having thought about it.

OK, we might be doing some business people a disservice here, but when a breach occurs, it's never very long before IT's phone starts to ring.

At the same time, it never ceases to amaze IT people, particularly those in support, how irresponsible some users can be. No one reading this needs a lesson in the risks that irresponsible or thoughtless user behaviour represents, but when it comes to laptop usage, it focuses the mind to see some of the common exposures listed together:

  • Leaving equipment unattended, on view and wide open to theft in cars, coffee shops and other public places.
  • Bringing sensitive information up on screen for anyone in close proximity to read when sitting on the plane, train, etc.
  • Having everything set up to automatically log in to systems and websites with usernames and passwords saved locally. Break into the machine, and you're into everything else.
  • Letting someone else 'borrow' their laptop to get online for a few minutes to check their email.
  • Letting the kids play on their PC, load dubious software from dubious sources, and access dodgy sites on the internet.
  • Loading dubious software from dubious sources, and accessing dodgy sites on the internet themselves!
  • Disabling or working around security measures implemented by IT because they're inconvenient and slow things down.
  • Connecting to any wireless network available without any thought about who owns it and who else might be on it.

These are just examples, and I am sure you can think of more.

The obvious one we haven't mentioned is the minefield created by the ease with which information can be copied and exchanged via removable media such as USB keys. Mobile users with laptops are particularly prone to exposure here, as they typically interact routinely with more external people with whom they are likely to want to share information. Apart from the risk of sensitive data ending up in wrong hands, there is always the chance of picking up malware from others’ devices that the user plugs into their own machine.

The reality is that the weakest link when it comes to mobile security is the user, not the technology. So how do we deal with this?

Well, putting some policies, procedures and guidelines in place is an obvious place to start if they don't exist already. However, Reg research conducted a while back (pdf) in relation to mobile working in general suggests that this itself isn't enough.

The feedback we received showed a strong correlation between the proactive training of users and their attitude and awareness with regard to security. Organisations who implemented formal classroom based training in particular stood out as having a much higher degree of confidence in their workforce:

With this in mind, we are interested in your experiences of dealing with the 'human factor' when it comes to laptop security. Examples of less than intelligent behaviour, views of the most common areas of exposure that exist and, in particular, experiences from things you have tried or implemented that have worked or otherwise would be interesting to hear.

If you have any thoughts about where the buck stops on this issue - with IT, HR, business managers or even users - then your feedback on that question would be interesting too. So, let us know what you think in the comments below. ®

New hybrid storage solutions

More from The Register

next story
Apple iPhone 6: Missing sapphire glass screen FAIL explained
They just cannae do it in time, says analyst
Quit drooling, fanbois - haven't you SEEN what the iPhone 6 costs?
How keen will buyers be when exposed to the real price?
Slap my Imp up: Bullfrog's Dungeon Keeper
Monsters need to earn a living too
Amazon axes hated Fire Phone price: 99 pennies but a niche? Ain't none
Forgive the double negative but seriously, no one wants this mobe
Apple's big bang: iPhone 6, ANOTHER iPhone 6 Plus and WATCH OUT
Let's >sigh< see what Cupertino has been up to for the past year
Apple's SNEAKY plan: COPY ANDROID. Hello iPhone 6, Watch
Sizes, prices and all – but not for the wrist-o-puter
The Apple Watch and CROTCH RUBBING. How are they related?
Plus: 'NostrilTime' wristjob vid action
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.