* When security is paramount over utility
The chief information security officer for an international peace organization recently said he deploys secure laptops to employees as they travel from country to country, gathering sensitive data.
Sorry for the mystery about the name of his group, but in order for him to talk for publication, he has to keep the name of his agency out of it. His bosses don’t want their member countries to get upset by something he might say that inadvertently offends them.
These laptops have cables to lock them to stationary objects so they don’t get stolen and all the data stored on them is encrypted. It would expedite review of the data the workers gather if they could use a VPN to transfer it, but they can’t for two reasons.
First, the government in the countries they visit often would consider such connections a security breach for their country. And the agency doesn’t want to put the data at any risk, even though it would consist of encrypted files that are re-encrypted into a VPN.
So the workers keep these laptops in their possession at all times and walk them back to the agency’s headquarters where the data is transferred to a secure network that has no WAN or Internet connection.
The security policy being followed is that the data cannot be exposed to any risk of leakage. That is the only priority, and the solution is the equivalent of a pre-networking “sneaker net” where data was carried on disks from machine to machine.
It is the extreme case where security is paramount even at the expense of utility. It points out the need for businesses to be flexible in imposing security on their own data. Yes, data needs to be secure, but business needs to get done. Security can’t be a roadblock. VPNs aren’t perfect but they are an excellent tool for maintaining security and supporting corporate tasks.
