Balancing Generation Y preferences with security

This is the final story in a five-part series about the key security issues that will be addressed at The Security Standard event scheduled for Sept. 10-11 in Chicago.

As young adults who grew up on e-mail and online chat enter the workforce, they bring with them a set of newer technologies designed for rapid-fire communication and workplace personalization. Much of this technology may represent better, faster ways of getting a job done, but it also introduces a new round of security threats for corporate networks; and the decision to allow them or not must be made carefully.

These technologies —personal gadgets like MP3 players, thumb drives, cell phones and PDAs; real-time communication technologies like instant messaging and text messaging; and social-networking Web sites like Facebook and MySpace — are part and parcel of the young workforce today, experts say. Called Millennials or Generation Y, this group is defined loosely as having been born between 1977 and 2002, and totals 70 million Americans — a large percentage of whom are bound to have one of the 100 million iPods sold to date in their pocket.

Many Generation Y technologies may offer an improvement over today’s status quo — an instant message or text message is likely to get the recipient’s attention more quickly than an e-mail that sits waiting to be checked in an in-box — but they can introduce serious security threats to corporate networks, according to some security vendors.

For example, “the newer forms of attacks take advantage of Web sites with rich content and features: AJAX-enabled applications, embedded JavaScript, etc. These aren’t really new technologies, but they’re more pervasive now,” says Paul Ferguson, network architect at Trend Micro. “And with [components like] Google Maps, where the processing is done on the PC instead of on the Web page, criminals are exploiting that avenue of content delivery. The ability for Web 2.0 applications to deliver that content is a Catch-22, because it also can allow you to be exploited.”

For security professionals, it may seem that the prudent thing to do is to disallow the use of this kind of technology in the workplace: blacklist non-business-related Web sites; ban handheld or pocket devices from the workplace; require employees to use company-issued and maintained laptops, PDAs and cell phones. After all, as many as 40% of employee Internet activity is non-work-related, according to IDC.