Identity protection for devices

Most people are familiar with the dangers that viruses and other malicious software pose to both organizations and individuals.  But did you know that's not the greatest danger out there?  According to the CW article, it's not.  Far more dangerous potential rests in the usernames and passwords that are used to gain access to networks and applications.

The organization that's done the study, Trusted Strategies, LLC, suggests that all it would take to help reduce the threat from stolen usernames and passwords is to implement device authentication--like identity theft protection for your devices.  I love it.  It's an excellent idea that organizations should put serious thought into implementing. 

According to the findings of the Trustred Strategies study, about 80 percent of breaches that involve stolen usernames and passwords happen from a computer that's not connected to the network.  If an organization could prevent computers that aren't registered on a network from accessing them, even with a correct username and password, the savings could be potentially tremendous.  And really, why would someone want to access a network from a computer that's not registered on that network?

There might be instances where a sales person or executive is in a position where they don't have access to a computer that is registered on the network, but those instances are relatively few in the grand scheme of things.  And surely the IT department could manage a way to allow temporary, monitored access in those situations.  For that matter, a no-exceptions policy would be the preferred method of implementing this type of technology, even if it is a little inconvenient for users.

That's the overarching issue with security on most levels.  Users find it inconvenient.  But convenience is creating havoc, and in order to get things under control, inconvenience is a necessary evil.  It shouldn't be easy for users to access corporate data.  It shouldn't be easy for users to gain access to corporate networks.  Extra steps would serve to discourage hackers and criminals, and users would be more protected.  Of course, most people don't see the benefits of a little extra inconvenience.  But over time, they'll get used to it.

So, go ahead.  Implement some device authentication.  And make the accessing process a little more difficult to navigate.  Then put in some ear plugs and resign yourself to being the least favorite person on the security team...at least for a little while.  When you data is protected, it'll be worth it.