Mobile Devices Bring Security Risks to WorkAdded 11th Jun 2012
Dropbox made headlines this week when Gawker.com was the first to report that an unnamed hacker broke into Mitt Romney's hotmail account with the same password used for a Dropbox account also associated with the GOP presidential candidate.
That followed on the heels of a decision last month by IBM to rollout a bring-your-own-device (BYOD) policy that bans the use of Dropbox.
IBM CIO Jeanette Horan initiated the policy because she's concerned that that the SaaS service could lead to the exposure of confidential corporate information, according to MIT's Technology Review magazine. (A survey by IBM of its employees found they were violating company rules by automatically forwarding internal e-mail to public Web mail services and using their smartphones as open Wi-Fi hotspots, opening corporate data to outside purview.)
Whether its Romney's email and Dropbox account or IBM's 400,000 employees, the risks associated with BYOD and cloud storage services highlight a problem IT shops now face: The potential loss of corporate data to an insecure public cloud. And it's not just Droxbox. There's a growing number of online consumer cloud services through which data can leak, including Box.net, Carbonite, Google Drive, Mozy, SugarSync, YouSendIt and Apple's iCloud.
"IBM has the world's BYOD program and they just locked down Evernote and Dropbox because they discovered their future product plans and all sorts of really sensitive data was being beamed automatically out to these services," said Dion Hinchcliffe, executive vice president of strategy at Dachis Group, a consultancy. "So they blocked all access to cloud storage applications."
Hinchcliffe said the use of mobile applications is a huge problem in enterprises, but companies have only begun to address the issue. He suggested that every company have a "bus stop" policy: If an employee wouldn't be comfortable leaving company information at a bus stop, they shouldn't be willing to store it in un unsanctioned public cloud.
While many enterprises now have a BYOD policy, they typically do not address the applications that come with mobile devices.
The concern about using public cloud services revolves around the fact that those service providers are becoming a favorite target of data thieves, just as robbers target banks.
"These cloud data centers are becoming high-value targets," Hinchliffe said. "You have to remember, 90% of all data break-ins are caused by someone inside the company with the keys to the castle -- a systems administrator that's being paid to tap a customer list or download customers' credit card information. So there's a lot of temptation in these data centers ... for people who are likely to supplement their incomes and will be tempted to offers.
"You can access not just one company's data but credit card files from hundreds of companies," he said.
Dave Malcom, chief information security officer of Hyatt Hotels, said he's keenly aware that employees use consumer-grade cloud storage services with their mobile devices -- and it's an issue he's already addressing.
He said, for instance, that employees often use the same passwords for multiple systems, including their own devices and web services. That means if an online cloud storage service is hacked, Hyatt's email system could well be at risk, too.
The hotel chain is now surveying employee workstations to find out whether cloud storage apps such as Dropbox have been downloaded and what kind of information is being stored.
"Obviously, that means there's probably a corresponding machine they're placing documents on that we don't own," Malcom said. "We're starting to try to get in front of it. Then we're trying to provide them with a corporately blessed service.
"Obviously, it becomes a lot more challenging with devices we don't own," he added.
Cloud content sharing service SkyDox released a survey on Thursday that shows more than half of all employees leave their IT departments in the dark about the free file-sharing platforms they use to upload corporate documents. The survey of more than 4,000 employees was conducted from April 16-30, and it showed that 77% of employees require access to work documents outside of their office - especially those who work in financial services (89%), professional services (96%) and healthcare (70%).
To enable that access, 66% of employees are using a free file-sharing platform to store or share corporate documents. That percentage spiking to 87% for those in professional services and 84% for those in financial services.
Of those using file-sharing platforms, 55% do not notify their IT department of the file-sharing platforms they use. For some workers, that number is greater. For instance, 71% of employees in sales withhold information from IT, compared to 5% of respondents who work in financial positions.
The survey also r
Riverbed Technology has released a rebranded SteelFusion line of storage appliances, signaling its intention to further centralize its branch office lines and combine as much functionality as possible into a single device.
Red Hat is looking to advance the Docker Linux container application for wider enterprise use.
In a surprise announcement, enterprise asset intelligence company Zebra Technologies said it is acquiring Motorola's Enterprise business for US$3.45 billion in an all-cash transaction.
Microsoft may have ended support for Windows XP, but free antivirus software vendor Avast projects that for millions of users, that won't mean squat.
Microsoft is targeting the growing volume of data being generated by both machines and humans: CEO Satya Nadella on Tuesday showed off tools that could help organizations better understand -- and profit from -- this trove of information.
SAP user groups are stepping up pressure on the vendor over the fees charged for its user-friendly Fiori applications, saying they should be included as part of the substantial annual maintenance costs customers already pay.
Intel is trying desperately to grow its share of the tablet market, and with Windows flunking out on those devices, Android is where it's at.
VMware started patching its products against the critical Heartbleed flaw that puts encrypted communications at risk, and plans to have updates ready for all affected products by Saturday.
In the race to protect themselves from the Heartbleed vulnerability, enterprises could be opening themselves up to new attacks if they aren't careful.
The operator of an independent website aimed at helping users of J.D. Edwards enterprise resource planning software has shut it down after Oracle alleged the site infringed on its copyrights.
Big data analytics are driving rapid growth for public cloud computing vendors with revenues for the top 50 public cloud providers shooting up 47% in the fourth quarter last year to $6.2 billion, according to Technology Business Review Inc.
Microsoft is updating its Web-based Office Online suite, narrowing the features gap with the main Office 365 and Office 2013 suites installed on users' devices.
While almost all of the attention has centered on patching Web servers and advising users to change their passwords, security researchers have discovered that individual client PCs and devices are also at risk thanks to "Reverse Heartbleed."
McAfee has released a free 'Heartbleed checker' to help internet users easily gauge their susceptibility to the Heartbleed Bug.
Akamai Technologies, whose network handles up to 30 percent of all Internet traffic, said that a researcher found a fault in custom code that the company thought shielded most of its customers from the Heartbleed bug.