Human and computer viruses are both security risks

The U.S. federal government is worried about the Swine Flu (official name: 2009 H1N1 influenza virus). There have been predictions by experts of two or three times the normal number of flu related deaths this coming flu season - maybe as many as 90,000 deaths in the United States - but official government forecasts say that the number is likely to be far lower. In spite of the disagreement over the number of deaths there seems to be a general agreement that millions of people in the United States will fall ill from the virus. There also is general agreement among governmental officials that the flu is going to cause major disruptions - including in the workplace, and that could present some significant security challenges.

Swine flu threat raises telework questions

In mid August the Secretaries of the US Departments of Commerce, Health and Human Services and Homeland Security announced new federal guidance from the Centers for Disease Control (CDC) for businesses in regards to the Swine Flu. They also pointed at government Web site focusing on flu related issues. The CDC guidance is quite extensive and useful as businesses work out their own flu response plans. One of the clear messages from the CDC is that a lot of employees will be staying at home, some because they get sick, some because their kids get sick and some because their kids schools closed or because a business decides to reduce the spread of the flue among their employees by telling them to work from home. In any case there is likely to be a lot of additional employees wanting to, or needing to, work from home. Are you ready?

Allowing employees to do sensitive company work at home creates a number of security issues. In order to minimize some of these issues companies need to develop and promulgate clear policies on what information employees can access from home and how it must be protected. The newly revised regulations for implementing the Mass Identity Theft Law require companies to develop "security policies for employees that take into account whether and how employees should be allowed to keep, access and transport records containing personal information outside of business premises."

This is one of the requirements that survived the recent evisceration of an earlier set of regulations designed to implement the law.