Dont Let Your Data Become an MPFree-For-All

David Beesley of Security Consultancy Network Defence looks at the threat businesses face from handheld USB devices and how to secure core business systems against them, without sacrificing productivity.

Handheld USB devices have been a godsend to anyone who wants to take information from one PC to another, but their ease of use also has created a new type of security headache for companies.

The recent explosion in sales of devices such as USB sticks, iPods and PDAs mean they are a common sight in most offices. 

Wheres the harm in an iPod, you might ask.  Surely the most offensive thing about an iPod is the often dodgy choice of music coming from it?  But when you consider that these tiny portable media devices can just as easily be used to remove confidential customer files, there is a clear menace behind the shiny chrome exterior.

So what steps should businesses take to protect themselves against the risks associated with such devices?

Keep your enemies close.  Keep your workforce closer.
The biggest threat to the integrity of a companys IT security is not some sinister hacker trying to break into the corporate network, but employees and partners with easy access to business information.

With removable media devices such as MP3 players, digital cameras, and PDAs commonplace in companies, uncontrolled use of them carries a number of risks, from the simple nuisance factor of the network being used to store personal files and the risks associated with software theft, to the consequences of a deliberate attack on the network.  The storage device is also a simple way for malware to propagate within your network; a user can unwittingly infect the network with a virus that has been transferred from his home PC by such a device.

The right security strategy
Its a worrying fact that around 80% of IT security incidents occur inside an organisation, and yet an estimated 80% of security spend still goes outside on perimeter defences such as firewalls, anti-virus, intrusions detection and content filtering. 

Businesses need a formalised control mechanism in place in order to protect critical business systems and databases for data and IP theft.

If you decide to outlaw USB devices, good luck. This is a difficult proposition, and there's no foolproof method. Windows 2003 will block USB port access, but critically, will also stop USB keyboards, mice and other legitimate USB devices being used a move that will not be popular with employees.

Simply disabling USB ports is therefore not the answer, as it inevitably has an adverse effect on business productivity and flexibility

Striking the right balance
Its important to have an Acceptable Usage Policy (AUP) in place, so that employees are aware of what they may and may not use in the workplace.  However, relying on AUPs alone is insufficient organisations need to back up any policy with robust enforcement capabilities.

A wholesale ban on portable media devices is not the answer.  Certain employees across an organisation will have a perfectly legitimate need to use removable media, be it a USB stick to transfer data or a PDA to synchronise diaries.

Not all employees will need such access, so a flexible solution is needed for permissible usage and blocking unauthorised connections.

The right Device for the Job
An example of this is DeviceWall a simple but effective means of restricting access to certain devices that can be tailored for individual members of staff and their IT needs.  It does not simply lock down ports, so does not impact on the use of legitimate USB devices, and can be automatically deployed to all PCs on the network.

DeviceWall enables organisations to protect themselves against malicious and accidental computer misuse by managing access to USB sticks, iPods and other media players, PDAs, memory cards, and internal CD and DVD writers.

You can keep connections open for legitimate devices that are not capable of storing data, such as mice, keyboards and printers, while maintaining a user policy-based barrier against unauthorized connection of portable storage devices.

In this way, IT mangers have a flexible yet robust means of separating corporate IT devices from lifestyle IT devices, enabling them to take a granular, user-based approach to enforcing security policy and reducing vicarious liability.

For more information why not visit networkdefence.com