4 ms·

Why can your employees access resources that aren't approved in the first place? Considering their machine contains such sensitive information, that seems irres

Why can your employees access resources that aren't approved in the first place? Considering their machine contains such sensitive information, that seems irresponsible.

eropple 10y ago
Because some of those employees are database administrators and business analysts. Because others are customer service reps. Because how do you do a job without the data required to do a job?
jerf 10y ago
Who said they're not approved? People get approval to access all sorts of things that they aren't supposed to let out of the company. Or may be obligated to take certain steps to ensure that it's not just on the good graces of the employees to ensure doesn't get out. There's no squaring the circle here. You can not lay obligations on corporations to secure their stuff, but not permit them to have any tools that allow them to actually implement that security, and expect security to be the result. You can't assume that all employees of all companies everywhere that deal with sensitive information are solely staffed by angels, especially in light of the fact that the very fact that they deal with sensitive information can attract people who deceptively pose as employees long enough to get their hands on this information.
- 3pt14159 10y ago
  I agree with jerf here. In many cases I think the answer should be to create certain systems that are almost always offline (say after installation). We shouldn't be connecting the same computers that hold health records to the network that the doctor is checking Ask MD in the back office.
  - cmdrfred 10y ago
    This is my point exactly. If you need to access health records you don't need to simultaneously access Facebook or Twitter. All resources should be approved, IE have a legitimate business purpose. This can be done easily in any enterprise firewall, simply implement a white list of acceptable sites and block everything else no DPI required.
Spooky23 10y ago
Why do we have homicide detectives? Murder and manslaughter are illegal!

Why can your employees access resources that aren't approved in the first place? Considering their machine contains such sensitive information, that seems irresponsible.

eropple 10y ago

Because some of those employees are database administrators and business analysts. Because others are customer service reps. Because how do you do a job without the data required to do a job?

jerf 10y ago

Who said they're not approved? People get approval to access all sorts of things that they aren't supposed to let out of the company. Or may be obligated to take certain steps to ensure that it's not just on the good graces of the employees to ensure doesn't get out. There's no squaring the circle here. You can not lay obligations on corporations to secure their stuff, but not permit them to have any tools that allow them to actually implement that security, and expect security to be the result. You can't assume that all employees of all companies everywhere that deal with sensitive information are solely staffed by angels, especially in light of the fact that the very fact that they deal with sensitive information can attract people who deceptively pose as employees long enough to get their hands on this information.

3pt14159 10y ago
I agree with jerf here. In many cases I think the answer should be to create certain systems that are almost always offline (say after installation). We shouldn't be connecting the same computers that hold health records to the network that the doctor is checking Ask MD in the back office.
- cmdrfred 10y ago
  This is my point exactly. If you need to access health records you don't need to simultaneously access Facebook or Twitter. All resources should be approved, IE have a legitimate business purpose. This can be done easily in any enterprise firewall, simply implement a white list of acceptable sites and block everything else no DPI required.

Spooky23 10y ago

Why do we have homicide detectives? Murder and manslaughter are illegal!