Merry Christmas! You're A Security Threat

If you are the proud recipient of a shiny tablet or state of the art smartphone this Christmas and you plan to use it at work, attaching to the corporate network to download emails and some data, then you are a security threat.

BYOD (Bring Your Own Device) is fast becoming the biggest threat to corporate security as people synchronise files over all their devices, regardless of whether they are company owned or not, using technology like Box.net, Dropbox, Evernote, Microsoft OneNote and Google Docs. It's the biggest advantage of the new age of such devices and the emergence of Cloud applications to enable such working. But that massive advantage to productivity comes at a cost.

To date, CIOs reamin somewhat laissez faire to the whole issue, but all you need is an executive's iPad or smartphone to get stolen and, suddenly, a non-company owned and controlled asset could be in the hands of a nosy stranger or, worse still, a thief. Although some devices can require the input of a 4 digit pin, that could be fairly easy to get around. Then you have all the applications on the device that have accessed the corporate data, like email and office productivity tools and any files that may be shared on common storage areas.

While there are ways to protect the machines and the data more rigorously, few fall under the remit of the central security policy of big companies - and that has to be a Governance issue at minimum. In the world of the US SOX regulations, that could be corporate negligence which Directors sign up to personally.

It isn't actually the users' problem, you might argue. But as many of the users of BYOD devices are company directors or senior management then I would argue there is a responsibility in many cases.

This year, BYOD will raise its head on the agenda of many big companies but it will be hugely important to SMBs too. As more technology moves into the Cloud, it may become less easy to know exactly what assets are accessing your network and where. 

Companies like Bradford Networks have a strong solution tuned to the BYOD threat to turn it from threat to a major productivity opportunity. 

You just have to make sure you control of the access to data on your network. It's been the core requirement of IT departments and remains so.

Cal +44 207 193 2356 for more information.

Who Owns Your Data in the Cloud Then?

Dropbox - a belter of a product/service. It's a handy App downloadable on any device that sort of acts like an extension of your PC or Mac file structure and is offered as free online storage for Apple, Google and other tablet and smartphone devices - meaning you can see files across platforms. You can share folders and files with other people, ideal for showing pics to relatives or working on projects.

But now that your data is in the Cloud, who owns the data?

Of course, the assumption is that it was your data before you put it there so it remains your data until you decide to take it back. Well, that isn't actually true. You see as with Dropbox and many other companies even as diverse as iCloud, Box.net, iTunes, Google, Facebook, Photobucket and others all have detailed Terms of Service which you agree to when you click the box accepting their terms.

I don't suppose you have ever read them and perish the thought of passing them through a legal department. While you may think this would be added bureaucracy for a consumer, businesses are allowing employees to sign up to these services daily from many devices and dropping in company data. The reality is that most of these Cloud companies can assert complete control on the data you have deposited into their custody. Most people and all companies would not willingly give away rights to their data or privacy if they really knew what they were agreeing to but actually this is going on all the time.

So consider Twitpic which is a service where you can add a picture to Twitter. If you delve into the ToS you will see that this company can distribute your 'data' to other companies. Of course, what they mean is that they can 'syndicate' it to Tweetdeck or other Twitter clients but the wording is not specific to describe this and many users have challenged these terms. But many haven't.

In Dropbox's ToS you are basically agreeing for your files to be placed in the Cloud. Users have questioned recent updates to Terms by Dropbox but effectively you are granting them permission to control your data in the web. 

The simple fact is that most people don't read the ToS when they sign up to all these services because we are believing we are getting free storage and neat facilities that allow us to back up and share files easily and cheaply leveraging the Cloud to its full benefits.

I dare say this does not pose a problem to most of us but you can bet your bottom dollar it will some day. What happens if one of these companies goes bust? What happens if these companies do run short of cash and sell your data on? What happens if one suffers a major crash and loses or corrupts your data? What happens if there is breach and your data is compromised? What happens if you want to terminate the service - can they keep a copy?

As a quick experiment, try deleting some files in Dropbox and then go into the main web app and look what has happened to them. Still there? Yes they are. The originator of the file has to delete and then confirm delete and even then I have seen files reappear which not only clutters up your free storage but it questions who actually owns that data?

Do you know?