A rational look at By Your Own PC (BYOPC)

Matthew Clark writes a rational overview of BYOPC on his Confessions of an IT Manager blog, addressing the benefits and concerns of such schemes. One of his concerns is naturally security:

To be clear, there are many possible security issues and implications with BYOPC.  These include virus and malware issues, installation of unknown software packages, secure access to business data, and so on.  However, I believe all of these issues can ultimately be resolved or mitigated with a well constructed security model.

In conclusion however, Mark writes that the concerns he addresses in the article can be managed and if properly managed, BYOPC could bring advantages in some environments, but is not convinced that BYOPC will necessary reduce costs.

Also in a recent report, Gartner suggests that BYOPC can increase the threat of botnets.

AppSense to include User Rights Management in user virtualization solution

Monday 20th September, AppSense announce the integration of User Rights Management into their user virtualization solution. For more information on URM and the development of User Installed Applications, check out Can You Give Power to Users Responsibly?

Least Privilege Security book review by security expert Kevin Beaver

Another positive review of the book:

I've been reading through Russell Smith's new book Least Privilege Security for Windows 7, Vista and XP and I've realized it's about time for a book on this subject. I've covered some of the material in the past including in my recent SearchWinIT.com tip Should Windows users have full administrative rights? and I know there's content on this topic scattered across various books, articles, etc. but I've never seen a book dedicated to the subject. Pretty cool.

Deploying software to computers without Group Policy

Need a quick way to deploy software to standard users without SCCM or Group Policy? Take a look at PDQ Deploy from Admin Arsenal. It’s free, can deploy MSI, MSP, MSU, EXE and Batch files and monitors installs until they’re complete. Make sure you test your unattended installs thoroughly before pushing them to multiple machines on your network.

Consumerisation of IT

There’s been a lot in the press during the last week about IT consumerisation, and how IT departments might become extinct if they continue a line of ‘command and control’.

In an ideal world, we’d let users buy whatever hardware and software they see fit to do their jobs. In certain environments this may actually work, but I imagine that for the most part, this would be a costly nightmare for the average IT department.

Is there a compromise? I think for the time being, allowing users to choose which software to use to process company data is something only the big players are likely to be able to achieve. If we let users buy their own hardware, you could consider providing a list of authorized devices.

If you don’t want to remove admin rights from a user’s PC, consider deploying a virtual desktop where you can comply with regulations and business needs for securing data. This way, you get the best of both worlds. It doesn’t have to be all or nothing.

A Strong Password Isn’t the Strongest Security

Great article over a the New York Times on password security.

“Keeping a keylogger off your machine is about a trillion times more important than the strength of any one of your passwords,” says Cormac Herley, a principal researcher at Microsoft Research who specializes in security-related topics.

Least Privilege Security, as part of a defence-in-depth security strategy, can help to keep keyloggers and other malware off users’ systems.

Herley continues by adding:

Security advice simply offers a bad cost-benefit tradeoff to users.

And according to the research:

“If an account is locked for 24 hours after three unsuccessful attempts,” they write, “a six-digit PIN can withstand 100 years of sustained attack.”

3 IT mistakes that helped bring down Russian spy ring

An interesting article over at IT Manager Daily that describes some of the basic security mistakes made by the Russian spy ring. One thing’s for sure, they weren’t using least privilege security…

In addition to clear and enforced security policies, the spy ring could have used some better help desk support. Some laptops took months to troubleshoot, and one spy was so frustrated with her computer that she turned it over to an undercover U.S. agent who promised he could repair it.

All these mistakes go to show that the spies’ targets may not have much to worry about — and that, once again, everybody needs IT.