Comment by awakeasleep | Hacker News Reader

Comment by awakeasleep | Hacker News Reader

Parent Full thread

Within a business, security has to be understood in the context of risk analysis.

Will the measures taken damage the company more than the benefit of the increased security?

In my eyes, banning storage media without a practical replacement is on the wrong side of the risk analysis equation. Sure, it's not desirable that files can be moved without full access control and auditing, but if people don't have a tool that works the same way then all your employees who rely on it will suffer.

It would have been great to see a standard encrypted portable drive, probably with the decryption software on a different partition establish a foothold in the world. With the addition of DLP software, that could have allowed employees to continue to do their work while mitigating the risk of lost or stolen data.

edit: what this doesn't cover is transferring large files quickly, or transferring files to a computer that isn't currently configured with the systems required for file transfers.

With the rise of VPNs, fast home internet, and fairly ubiquitous public wifi along with laptops gaining enough power for most applications the question is what's the real use case that requires removable media that can't be accomplished with an internal FTP/network drive/email and using company laptops?

>"fairly ubiquitous"

If I'm giving a presentation to hundreds or thousands of people in 30 minutes and a laptop goes down/won't connect to projector, presentation wasn't loaded or was corrupted on the speaker laptop, things go sideways in a bunch of other ways (and they do), I don't want to be in the position of depending on the network to pull down a presentation from somewhere. Especially if I don't have my own laptop with me as is at least sometimes the case.

There should be various other ways to get to a presentation and I even have a setup to present from my iPhone (which I've actually had to use as a fallback), but a USB stick is a good, simple backup that I've used more than once.

Sometimes security is annoying, and sometimes security means you don't get to do what you needed to do. An event with hundreds or thousands of people should have rehearsals and spare speaker laptops, but if they don't, your need to present doesn't trump your (or someone else's) employer's cyber security stance.

Show up at a building site without your helmet and hiwiz? Unless there's a spare set around, you're going home. We need to get into the same mindset around cyber security.

It's going to depend on the circumstances and, perhaps, we really will decide over time that moving USB keys among untrusted laptops is simply a bridge too far. But, literally just this afternoon, used a USB stick to transfer a presentation to a (supposedly clean) speaker laptop that hadn't been preloaded like it was supposed to be. The circumstances (~100 person event, no rehearsals or heavyweight IT support) made that seem reasonable.

Cybersecurity is indeed important. But it's about managing risk, not minimizing it no matter the cost. And what I'd do at an event like this one is quite different from Defcon where I'd take the most stringent precautions possible.

There are drives that you can physically disable write on: https://www.kanguru.com/

Offshore work, for instance.

Lots and lots of vessels have painfully slow satellite links - think <=64kbps - whereas the others mostly have very slow satellite links - ~512kbps.

Trust me, in such conditions you do not want to cough and ask whether you can download your training material off the corporate VPN...

(Heck, in many cases, shipowner policy prevents any third party computer from being connected to any onboard IT infrastructure, anyway.)

Working at sea; an Antarctic base; Mars; etc. is very much a niche for which specific exceptions can be made, but is irrelevant to almost all employers. In most cases security is the greater concern.

In context of the original post though, it's unlikely IBM engineers are doing much work on ocean going vessels with 64-512kbps satellite links

A hybrid structure, that is, allowing the transfer of files through portable drives however only allowing it to be saved/read encrypted to approved devices through encryption keys managed on devices or through the network (Group Policy/etc) could work.

I just bought a new SanDisk USB 3 drive and noticed it comes with SecureAccess software. It uses 128-bit AES encryption. Better than nothing, we could think IBM a large and successful long term tech company could make their own. But that doesn't support the cloud vision.

In this case, is cloud storage not a practical replacement?

The analog loophole. If I can access the resources from my local device. The odds are I can get a copy of it without the protections on it.

Reply on news.ycombinator.com