All posts by David Willson

Security

Technology and the Workplace: BYOD

3 Comments

The latest buzz word or acronym around the water cooler is BYOD or bring your own device. Use of mobile devices has sky rocketed over the last year with the iPhone, iPad, tablets, Android, etc. Everyone wants the latest and the greatest. But, who wants to carry around two devices, the company’s and your own? Even if you don’t mind carrying the extra device, how many man-hours do employers lose when employees are exploring and surfing their new mobile devices at work?

It may be better, depending on the business, to just allow employees to use their personal devices for work. This issue is similar to the controversy over whether to allow employees to use social media. On that one, cat’s out of the bag. They are. So put a policy in place to set parameters to benefit and protect the company. But BYOD, whoa, how many privacy, security and legal issues does this generate? A lot!

As an employer, what can you do? Again, put a policy in place and do it now. Don’t just throw something together piece meal as you go along, do it right.

Now, this may sound a little self-serving, but, commonsense dictates having it drafted by a lawyer who is familiar with the technology, privacy, and other issues to ensure your company is protected, and consequently so is the employee.

The policy or policies need to address questions such as can you monitor the personal device; implement encryption; require anti-virus; tracking, secure wipe; use of passwords; etc.? The answers, by the way, are yes, yes, and yes.

Best plan is to have a monitoring policy and a mobile device use policy, or BYOD policy, and give employees the option: “if you wish to use your personal device at work you must agree to the terms of the policy.” The alternative would be to use the company device, aka “the brick”, if they are not willing to accept the terms.

Bottom line: a well thought out and well drafted policy or policies are the key! Watch for the next installment of “Technology and the Workplace.”

Security

Hacking Back Part II

Leave a comment

In my last blog on “Hacking Back” I asked is it legal, ethical, and do I have a right to defend my network against yours? Well, I believe it is legal and ethical, and absolutely, I have the right under “self-defense” to defend my network from being attacked by yours, even if you do not know that your network is attaching mine!

Obviously if I know who you are and can contact you I would be obligated to do so. This scenario assumes I have no idea where the attack is coming from.

When considering hacking, hack back, self-defense in cyber space, etc., you must consider the fact that everything happens literally at the speed of light. So, saying I must contact law enforcement, collect evidence, and go to court is the same as saying “just accept it, and hope to recover all of your losses from a court, even if your company has since been put out of business.”

Here is my next question for comments:

Does anyone wish to argue that if their network has been compromised by hackers and is attacking others without their knowledge, the party or parties they are attacking have NO right to take action to stop those attacks?

My hacking back article can be found on Titan Info Security Group under white papers.

Security

The Legality of Offensive Hacking

3 Comments

This is Part I in a series of articles on hacking back or aggressive cyber defense. The questions I would like to explore, and ask for comments on are whether hacking back in self-defense is legal or illegal; ethical or unethical; should be pursued with clearly defined parameters or in a wild west manner, and more?

If you have read my article, “Hacking Back In Self-Defense: Is It Legal; Should It Be?,” you are aware that I believe hacking back in self-defense, in certain circumstances, is legal.

When I lecture on this topic though, I get at least one person in the crowd who is adamantly opposed and claims it is it illegal. Usually when their argument is analyzed it comes down to an ethical argument rather than a legal one.

So, in addition to the questions I have posed above, I ask one additional one: if your system has been compromised and is being used to attack my network or computers, do I have the right to hack back or aggressively defend my network against your attacking system, even if it means my defense may disrupt your computer or network?

Please provide comments below and I will continue in a few days.

Security

Employee Use of Social Media

1 Comment

A few of the tracks at RSA discussed employee use of social media, the security risks it may cause, and employees’ rights and advice for employers. A recent settlement highlights some of the issues.

A Connecticut American Medical Response (AMR) employee was fired for making negative comments on her Facebook account about her boss. According the National Labor Relations Board (NLRB), the complaint alleged that the discharge violated federal labor law because the employee was engaged in protected or concerted activity when she posted the comments about her supervisor, and responded to further comments from her co-workers. Additionally, the company maintained overly-broad rules in its employee handbook regarding blogging, Internet posting, and communications between employees.

Under the National Labor Relations Act, employees may discuss the terms and conditions of their employment with co-workers and others. “Concerted activity” includes any activity by individual employees united in pursuit of a common goal. The activity must be in concert with or on the authority of other employees, and not solely by and on behalf of the employee himself. (Meyers Industries, 281 NLRB 882 (1986)).

There are also potential First Amendment issues when an employer attempts to limit employees’ speech on social media. Consider including in any company policy a provision on the use of social media by employees. Social media can potentially mean huge security risks for employers. Any policy should be clear, concise and understood by employees. It is also highly recommended an attorney review any policy.