True Insight

Slashdot has posted an item[slashdot.org] about the upcoming results of a survey by Symantec and Applied Research-West describing the threat to IT from the so-called ‘Millenials’ generation–those born after 1980. The IT threat apparently comes from the willingness of this young crowd to connect almost any device or social networking software to the corporate network. There is a positive in the report: Millenials are more likely to be aware of the security implications of what they are installing or connecting.

Whew…for a second there I thought my generation was going to be banned from working! It’s not like that would make that many of us angry…just don’t take away our Internets!!! You don’t want us to get angry!

Reuters is reporting[reuters.com] that Canadian soldiers have been ordered not to post personal information to social networking sites like MySpace[myspace.com] and Facebook[facebook.com]. The apparent motive is safety - “Al Qaeda operatives are monitoring Facebook and other social networking sites.”

Many have heard of the potential effects that sharing the wrong information online can have on our careers and social lives, but few would view death as one of those potential effects.  “This may seem over dramatic … (but) the information can be used to target members for further exploitation. It also opens the door for your families and friends to become potential targets as well.”

Are these soldiers and their families really in danger or is this an exaggeration or a command with a hidden motive?

Brian Granier with the Internet Storm Center[sans.org] compiled some interesting security findings[sans.org] from feedback sent by people working for and with Small to Medium Businesses. I have combined his analysis with some of my own in the pro’s and con’s to each finding.

1. All-in-one security products increasingly available at SMB prices
Pro’s: security needs being addressed
Con’s: over-emphasis on perimeter security, false sense of security provided by a device that is turned on and “left to do its job”

2. Commonly no full-time IT staff
Pro’s: IT and security needs can be outsourced to specialized companies (this can also be a ‘con’, if not managed well)
Con’s: IT and security needs addressed in a reactionary manner

3. Some cases of successful security integration, mostly motivated by external business pressures (i.e., regulations, customer demands)
Pro’s: security needs are being addressed, increasing understanding and support from management for security
Con’s: implementing security strictly to meet regulatory demands can often lead to tunnel-vision - addressing only what is regulated while potentially ignoring higher security risks

4. SMBs often ignore the insider threat
Pro’s: employee privacy, sense of trust
Con’s: insiders are more likely to cause security incidents and outsiders are often just one step away[truedigitalsecurity.com] from being an insider