Slashdot Mirror
Ask Slashdot: Do You Use a Smartphone At Work, Contrary to Policy?
Jason McNew writes: I have been in IT since the late '90s, and began a graduate degree in Cyber Security with Penn State two years ago. I have always been interested in how and why users break policies, despite being trained carefully. I have observed the same phenomena even in highly secure government facilities — I watched people take iPhones into highly sensitive government facilities on several occasions. That led me to wonder to what extent the same problem exists in the private sector: Portable Electronic Devices (PEDs) are a huge threat to both security and intellectual property. This question has become the subject of a pilot study I am doing for grad school. So, do you use a smart phone or other PED during work hours, even though you are not supposed to? Please let me know, and I will provide the results in a subsequent submission to Slashdot.
...No, I'm not kidding...at one position (where I was a contractor), I got a link to a 'Policies to Follow' online document, when I clicked on the link, I got a 'You are not authorized to view this page' message. So I wasn't authorized to view the policy I was supposed to follow.
At another position, where I was doing device support (i.e. handling all the physical devices) for my team, I tried to connect to corporate email using my company phone (obsolete, with a custom rom), I got two nasty grams from two _different_ company security groups for the connection attempts.
So, to answer the original poster, that item they have may not be their own, and everyone at the company works around the company rules, because they should have been applied to just a section of the company (or have taken into account the differences within company areas)
And that you have to check them at the door... It's not voluntary compliance.
Out of curiosity, what secure locations can you use your smartphone?
You ask why users break policies. I guess there can be many reasons but for me anytime a policy gets in the way of accomplishing a task, it gets broken.
Another way of saying this is polices are likely to be broken when policies conflict. While not using your smart phone may be a policy, getting your job done is also a policy. In this case people will generally choose to break the policy with the least personal risk. If I am more likely to be fired (or not paid my bonus) if I don't get my job done than if I use my cell phone, I am going to choose getting my job done and use the phone anyway.
If am using my phone against policy, I may also do things that are detrimental to the business while I am trying to hide my phone usage. At a minimum I am wasting time and brain cycles thinking about how to deal with the policy conflict.
There was this movie that among other things was about unintended consequences that can happen if you have conflicting policies / instructions. "Open the pod bay doors, HAL".
You've never worked in an actual SCIF then. There are no cameras, or devices with cameras, or recording features, allowed in those facilities.
And yes, people bring them in all the time anyway, either accidentally or intentionally.
It's sort of an arbitrary rule, since there are a plethora of methods to exfiltrate information, and in some of those facilities, the people who work there are, in fact, trained to extract information.
https://www.eff.org/https-everywhere
When I used to go to automotive plants, they'd search your bags and you weren't allowed to bring cameras in. Once everyone got a cell phone with a camera, they just gave up.
When we had our first kid (2008) they'd look at you a bit snarky if you had a cell phone in the hospital. By the time we had our third kid, there were medical interns texting in the surgical room (it was a C-section). Nobody batted an eye if you had a cell phone, though the signs were still up. In my doctor's office, he uses some kind of program to manage all the patient medical files, and there's a terminal (it's a Mac actually) in every examination room. He leaves it logged in even though there are theoretically steep penalties for violating patient confidentiality. Just looking at the screen you can see his whole schedule for the day. When he comes in, he doesn't have to type a password or anything to start entering data about my visit. Devices like insulin pumps are known to allow wireless connections without authentication, and even if there was authentication, let's face it, it's probably broken.
Not long ago I was doing searches for industrial equipment manufacturer names on Shodan and ended up connected to one of those big wind turbines, somewhere in the middle of the US. No authentication. It was a monitoring dashboard and I didn't poke around, just closed it, but there were suspicious links/buttons on there to access the industrial controls, such as the PLC.
There are so many vectors: web browsing, phishing, thumb drives and phones brought in from the outside, pwnies, wireless, executives taking laptops home or even to China, spoofed OS updates, hardware infected as the point of manufacturing, and those are just some of the ones we know about. There is no real security.
"I have never let my schooling interfere with my education." - Mark Twain