I ran across this cute little slide show on Network World that reviews a few of the more egregious cases of mobile IT security stupidity in recent months. I have argued for criminal penalties when personal information is compromised (this is an obvious hot button of mine), and they’re still needed. As I said earlier this week, personal information needs to remain just that, personal, and anyone compromising the information integrity of another should be guilty of a crime and severely punished.
Unfortunately, information security remains much too difficult; even the well-intentioned can’t always be sure. For small shops, it’s a pain; the tools just don’t exist in a usable form. For large shops, it’s also a pain; the tools are available here, but they’re still a lot of work to configure, test, deploy, and maintain. The basics are easy in concept: authenticate with all devices and information resources, ideally using a two-factor technique, and encrypt all sensitive data in storage and in transit.
Oh, wait, that does sound hard, now that I think about it. But that doesn’t mean that it doesn’t need to get done, and now. While, sure, the vendors could be doing a lot more, I’m sitting here wondering why so many IT professionals still don’t get it – if you can’t secure your network and your data, you shouldn’t be working in IT at all.
