Now Available:

line

Featured Resources:

line

Newsletter

Email Address:


line

Ask the Expert

Have a question for our resident expert? Email your questions to Rebecca.

« Enron, ethics and opportunists | Main | Do You Wipe Your Retired Computers? »

Loss of Blackberry = More Secure Info????

Blackberry lovers (known widely as "crackberries"...yeah, it's kinda clever) are in a tizzy since the U.S. Supreme Court refused to review a major patent infringement ruling against maker Research In Motion Ltd.(RIM), which manufactures the device.  A federal judge could now issue an injunction to block RIM's U.S. business.  Many pundits have stated they believe that RIM may develop an alternative technology or may pay millions to a billion dollars to settle with NTP Inc., which holds the patent.  See http://today.reuters.com/news/newsArticle.aspx?type=topNews&storyID=2006-01-24T224759Z for just one of the stories on this.  All I know is that the crackberries I know were fretting over the possibility of having to pay hundreds to possibly over a thousand dollars to keep their electronic link to the world if RIM settles, or that they will lose it altogether.

Yes…LOSE the Blackberry…meaning the technology as it exists today is no longer available to use.  The other kind of loss, which probably jumped into you mind when the heading caught your eye, is what truly scares me when I see how people use them.  One famous poster child of the risks involved with using Blackberries for work purposes is the story of the Blackberry purchased on eBay that contained massive amounts of Morgan Stanley information; some of it confidential information.  If you haven’t seen this story yet, check it out at http://www.wired.com/news/business/0,1367,60052,00.html.

Folks, these tiny amazing gadgets CAN do many wonderful things and allow for virtually non-stop connection with our business (ewww…is this what we really need, a 7x24x7 business in our pocket?).  However, a Blackberry can seem like electronic heaven on Earth for those gadget-loving workaholics.

Ok, enough with the glowing benefits of the Blackberry…their size and propensity to be lost or stolen is a huge risk to any information stored upon them.  I have performed many business partner security reviews to find that the business partner is storing their client’s data in clear text on these devices, but they see absolutely no risk in doing so…”oh, we are careful with them!”  ANd, sadly enough, when pressed to encrypt the information on stored upon the mobile devices, most of the business partners steadfastly refuse to do so because of the inconvenience and little bit of extra cost if would be to THEM!  (Heck, it's not their data...so why would they be so worried?)  If you outsource your data to any business partner who uses Blackberries, or any other mobile devices including laptops/notebooks, seriously consider having them contractually agree to never store any of your company data on these wonderful traveling liabilities.  Don’t just specify “confidential” information cannot be stored upon them; this is a subjective term, and your business partner’s definition of confidential may not be the same as your organization’s.  Besides, many types of information not considered confidential are still potentially embarrassing or capable of wreaking a public relations nightmare if discovered by the public.  This restriction may seem a little rigid, but I have worked with organizations and people long enough to know that if you place complete control of security in the end-users' hands, such as asking each person to please remember to delete information from their blackberries, it often does not get done, or it gets done sporadically at best.   It is the easiest and most effective security to contractually require them not to store any of your company information on them at all.  True, this won't prevent them from breaking your contract and storing data on the mobile devices anyway, but at least it gives you much more solid legal grounds to take action if they do.

Oh, and I haven’t even gotten to addressing how companies control the use of mobile devices by their own employees…that is a good discussion for another day.

So...maybe if they don't make Blackberries any more...if the owners lose them in this way...perhaps our data will be more secure...at least in some aspects...

Post a comment

(All comments are approved by site leader before appearing here. Thanks for commenting!)

line

Rebecca Herold's Bio:

Rebecca Herold,CISSP, CIPP, CISM, CISA, FLMI, has been providing information security, privacy and regulatory assistance and services to organizations from a wide range of industries for over 18 years. Rebecca was instrumental in building the information security and privacy program while at Principal Financial Group, which was awarded the CSI Information Security Program of the Year Award in 1998. IT Security ranked Rebecca as one of the top 59 IT security influencers, and Computerworld put Rebecca their list of the 25 top privacy experts and on their list of the 9 best privacy consulting firms. Rebecca has been CPO for two consulting organizations, and has had her own information privacy, security and compliance business since 2004. Rebecca has written chapters for several books, dozens of articles, and has been writing a monthly privacy column for the CSI Alert newsletter since the beginning of 2001, and is working on her 11th book. Some of her other books include The Privacy Papers, Managing an Information Security and Privacy Awareness and Training Program, The Definitive Guide to Security Inside the Perimeter (Realtime Publishers), The Shortcut Guide to Improving IT Service Support through ITIL (Realtime Publishers), and The Practical Guide to HIPAA Privacy and Security Compliance. In addition, Rebecca is the leader of The Realtime IT Compliance Community where she posts to her IT Compliance weblog. You can contact Rebecca at: rebecca_herold@realtimepublishers.net.