When desktop security is a remote possibility

Workshop You, the readers of The Register, have told us that supporting users is fraught with problems. And when it comes to looking after remote users things get even more difficult.

It is clear that running all remote users in thin client mode is a prospect that, while attractive, still does not fit well with a broad set of business requirements. Securing remote workers and their machines still needs skill, good tools and excellent processes. So we are going to drill down and take a look at some new management solutions and assess whether they ready to be exploited or could pose more problems than the security risks they seek to mitigate.

Some of the solutions being proposed and increasingly deployed to help secure laptops and remote PCs include encryption, device location tools and remote content locking and deletion capabilities. There is absolutely no argument that each of these approaches can enhance security when utilised appropriately, but it must also be recognised that each has its own potential pitfalls.

Take encryption. In the past many attempts to use encryption on mobile laptops were thwarted by the CPU overhead required to encrypt and decrypt files. Opening and closing files took so long that users quickly sought ways to sidestep the encryption tools as they made using the laptops too slow.

Times have changed and for a large proportion of laptops, the encryption overhead is now bearable. The raw processing power in the machines has grown, and encryption software has become more efficient. Problem over? By no means. When encrypting files on remote laptops becomes feasible, managing the keys that allow the files to be opened will become a sticking point. If the keys used to lock a file are lost or corrupted, the data itself may be irretrievably lost, taking valuable corporate information with it. There is also the small matter that in certain legal jurisdictions the law may make it a crime not to be able to unlock an encrypted file when so ordered.

Device location and content locking solutions also have drawbacks alongside their advantages. The ability to identify the physical location of a laptop when misplaced, lost or stolen is certainly information that could help avoid many business problems, and potentially speed up the time by which a user can be productive again. It can also help police and other authorities if the machine in question is especially sensitive or valuable. The opportunity to limit the impact of possible “data leakage” is an area where interest is likely to grow as privacy and legislative requirements become even more pronounced.

But once again, is this a solution many users will be happy with? The privacy issues are by no means insignificant and in many countries may be insurmountable except in exceptional circumstances. The “remote kill” capability that some solutions add to the mix needs to be the subject of a very well-managed process if information is not to be wiped accidentally or maliciously by an administrator with the privilege so to do. Clearly such tools need to be closely integrated with data protection systems and processes.

These solutions are still in the first flush of youth, and few organisations have managed to create effective procedures capable of working in a foolproof fashion. As the saying so neatly explains, “nothing is foolproof as fools are so ingenious”.

As with all new IT solutions, security technologies take time to evolve and lose the rough edges that are capable of stripping off the skin of the unwary IT administrator or manager. If you have good examples of how to keep your remote users happy with the security solutions you put in place, we will be very glad to hear your experiences. Equally, and maybe more likely, if you have any war stories where security solutions have caused you more trouble than they ought to, please let off steam about them here. ®