Plugging in peripheral devices into work computers and other assets like printers is pretty commonplace in today’s businesses. Employees in a lot of companies literally have free reign to plug in whatever they want – be it a smartphone that needs charging, an MP3 player, a camera with photos to be downloaded, or a memory stick to move information, says Richard Broeke, IT security expert at Securicom.
You aren’t alone if you have that niggling feeling that there is something inherently problematic with allowing everyone and anyone to plug-in what they like into a company asset. And, it goes beyond the questions around how much of it is work related and what impact the use of peripherals impact productivity.
That gnawing feeling has much more to do with the potential threat to IT security, the risk to the network, and the integrity of business data. That’s because we’ve all known for years that plug-in devices pose a threat. But, we’ve come to rely on the security mechanisms in place to block unwanted malware infections.
So what’s the problem really?
The trouble is though that endpoint security – the measures in place to protect an asset – isn’t really much of a focus these days. The focus shifted some time ago to protecting the network from risks arriving from the outside, neglecting the risks arising internally from employees inadvertently spreading malware via the unfettered use of peripheral devices.
TechAdvisory.org reports that 25% of malware is spread through USB or plug-in devices. Attacks are becoming more sophisticated and harder to detect because attackers use small circuit boards inserted in keyboards and mouse devices to launch malicious code when a certain key is pressed or condition is met. Some of them are launched automatically by the Autorun or Auto Play feature. Once the malware has infected the endpoint, it can steal or corrupt data, as well as spread to other computers in the network.
The other issue is data loss. Portable plug-in devices are easily lost, misplaced, misappropriated. What if there is sensitive or confidential information stored on a lost or stolen device like a smartphone or memory stick? What controls are in place, and enforced, to prevent employees from copying sensitive information onto moveable devices? And, if they are authorized to store or move sensitive data on a portable device or memory stick, is that information protected with encryption.
So you see, if you have that gnawing feeling, something niggling you, that perhaps your business could have better control over the use of peripheral devices, don’t ignore it. Give it a scratch!
Start digging a bit deeper and question just how good are the security measures you have in place to protect the computers on your network from USB-related risks.
A decent endpoint security solution should include antivirus, antispyware, intrusion prevention, device control and application access control.
Each and every endpoint should be equipped with its own firewall to protect it against threats that don’t originate from the internet, such as those infected USBs. A desktop firewall will also stop unsolicited outbound traffic from infected computers which could lead to infections and security breaches in other computers and external programmes.
You also want to have the ability to limit or prevent the use of plug-in devices, and control who is able to move business information onto portable devices.
Using a robust solution that encompasses all of these capabilities instead of having countless point solutions makes good sense. With a centrally managed endpoint security solution, security updates can be routinely applied, and authentication and access rules can be enforced – with the necessary regularity. It also offers the ability to limit or prevent the use of peripheral devices on company computers, as well as implement mechanisms to control which applications and business information certain levels of employees are permitted to access.
So refocus on the endpoint. Make sure that your business has appropriate levels of control over the use of USBs and appropriate protection against the potential risks. Then that niggle will go away!