3 ms·

Remote Work Exacerbating Data Sprawl

19 points by susam 6y ago

DoofusOfDeath 6y ago
> More than three-quarters of IT executives worry that data sprawl puts their data at risk, especially with employees working from insecure home networks, survey finds. I assumed that security-minded IT departments treated their networks as untrusted. I.e., that most of the security comes from secure hosts + secure point-to-point communications. And therefore running on a public or home network doesn't add much risk.
- dcolkitt 6y ago
  I think the sad reality is that most corporate IT executives are more interested in security theater than actual security.
  - TeMPOraL 6y ago
    Yup. This follows from the way corporations look at IT security. The two main things they care about are: - Compliance - because they need to tick checkboxes to get certifications, get contracts, and minimize liability; - Annualized expected losses - which they estimate by a process only slightly better than reading tea leaves, and then minimize by turning whatever knobs were identified as most impactful in the divination process. The assumption here is that in a large enough enterprise, breaches and outages are a fact of life - so the question is how much it'll cost and how to minimize that number. Source: I worked for a company building the product that automates the reading of tea leaves part. What I've learned is that the quality of risk estimates depends primarily on how diligent the people doing them are, and how good understanding of statistics they have - which is about the worst combination of requirements for busy executives.
- ArchOversight 6y ago
  Most corporations still treat anyone that is on their "corporate network" as trusted. VPN being used for remote workers generally, but endpoints are not well protected at all, and you still gain access to various resources just by virtue of having the right IP address and being able to route to something. As a security engineer trying to get companies to invest more in Zero Trust type technologies where endpoints aren't necessarily trusted just because they have the right IP, it's difficult to get that mindset to change.
- deleted 6y ago
  [deleted]
- satya71 6y ago
  Corporate IT is treated as a cost-center, not a productivity enabler and risk-mitigation center.
jsemrau 6y ago
I worked for a company that does bring-your-own-device and I am worried about how to verify that employees have deleted company goods (customer data, access keys, etc) once they have left the company.
- paulryanrogers 6y ago
  Keys should be revoked server side. So at least those should be easy to manage
- yencabulator 6y ago
  Exactly the same way you "verify" that they haven't kept printed copies / taken lots of photos of their computer screen / read things out loud to their lover on Saturday nights. That is, you don't. You set up legalese that lets you sue them in a way that hurts if they abuse that, or you go to real opsec where they're prevented from downloading/printing, and even only access data in a secure room where no cameras enter. As you have probably guessed, first option is typically the more realistic one.
- xiphias2 6y ago
  At Google we had a separate enterprise account created on the mobile phone if the employee opted for bring-your-own phone (at least for Android...I don't know about iPhones). For laptops this doesn't work, so the company has to provide it.
aronpye 6y ago
If you make security too onerous then people will just bypass it so they can do their jobs. We all know of people who write out passwords on postit notes as the password requirements make passwords impossible to remember. I also think power play often comes into security where IT invents or overstates risks just so they can lock down functionality to extend their influence.

19 points by susam 6y ago

> More than three-quarters of IT executives worry that data sprawl puts their data at risk, especially with employees working from insecure home networks, survey finds. I assumed that security-minded IT departments treated their networks as untrusted. I.e., that most of the security comes from secure hosts + secure point-to-point communications. And therefore running on a public or home network doesn't add much risk.

dcolkitt 6y ago
I think the sad reality is that most corporate IT executives are more interested in security theater than actual security.
- TeMPOraL 6y ago
  Yup. This follows from the way corporations look at IT security. The two main things they care about are: - Compliance - because they need to tick checkboxes to get certifications, get contracts, and minimize liability; - Annualized expected losses - which they estimate by a process only slightly better than reading tea leaves, and then minimize by turning whatever knobs were identified as most impactful in the divination process. The assumption here is that in a large enough enterprise, breaches and outages are a fact of life - so the question is how much it'll cost and how to minimize that number. Source: I worked for a company building the product that automates the reading of tea leaves part. What I've learned is that the quality of risk estimates depends primarily on how diligent the people doing them are, and how good understanding of statistics they have - which is about the worst combination of requirements for busy executives.
ArchOversight 6y ago
Most corporations still treat anyone that is on their "corporate network" as trusted. VPN being used for remote workers generally, but endpoints are not well protected at all, and you still gain access to various resources just by virtue of having the right IP address and being able to route to something. As a security engineer trying to get companies to invest more in Zero Trust type technologies where endpoints aren't necessarily trusted just because they have the right IP, it's difficult to get that mindset to change.
deleted 6y ago
[deleted]
satya71 6y ago
Corporate IT is treated as a cost-center, not a productivity enabler and risk-mitigation center.

jsemrau 6y ago

I worked for a company that does bring-your-own-device and I am worried about how to verify that employees have deleted company goods (customer data, access keys, etc) once they have left the company.

paulryanrogers 6y ago
Keys should be revoked server side. So at least those should be easy to manage
yencabulator 6y ago
Exactly the same way you "verify" that they haven't kept printed copies / taken lots of photos of their computer screen / read things out loud to their lover on Saturday nights. That is, you don't. You set up legalese that lets you sue them in a way that hurts if they abuse that, or you go to real opsec where they're prevented from downloading/printing, and even only access data in a secure room where no cameras enter. As you have probably guessed, first option is typically the more realistic one.
xiphias2 6y ago
At Google we had a separate enterprise account created on the mobile phone if the employee opted for bring-your-own phone (at least for Android...I don't know about iPhones). For laptops this doesn't work, so the company has to provide it.

aronpye 6y ago

If you make security too onerous then people will just bypass it so they can do their jobs. We all know of people who write out passwords on postit notes as the password requirements make passwords impossible to remember. I also think power play often comes into security where IT invents or overstates risks just so they can lock down functionality to extend their influence.