Pandora for business

[hedwards]

1. A pandora would not introduce any new security risk to Kumaki's company
2. A pandora could be used in part of a 'cyber' attack on a database server

People are arguing about something they agree on, and then argue about whether or not they agree with each other, even agree that they disagree on whether-or-not they agree with each other on the original issue.

I wish they would fix quoting so that you can add in another quote.

It's not so much a new security risk, as it's likely a unit for which the IT department doesn't already have a plan and likely isn't monitoring. The IT guys do indeed need to know what's on the network so that they can plan accordingly. And even if it's just one device, the IT department really needs to monitor the vulnerabilities with it anyways. It's hardly unusual for somebody to crack a workstation with infected wares to get at the server from inside the firewall.

So, it's not so much that it's a new risk as it is a risk that isn't necessarily on their radar. It is likely a lower risk than a more commonly used device, but any device can have a vulnerability and allowing people to install random apps onto it would represent a risk. Not that I'm personally concerned about the PNDs, but there's a fair few Android apps that contain all sorts of security headaches which could potentially violate company policies.

I'm a bit surprised at how my comment went pear shaped, I don't recall having said that the device should be banned, merely, that it might not be permitted on the network. For better or for worse a more commonly used device like an iPhone is likely to be better researched than a Pandora is, and whatever risks there are are more likely to be known about and prepared for. I personally trust that the developers are taking security seriously, but it's easier to miss bugs and holes when the platform is of little interest to crackers.

 

[klapse]

Seems to me that the people debating with Kumaki are missing her point: The pandoras isn't a risk to her SPECIFIC business. The pandora doesn't give anyone access to the patient data on the XP box. Even if the pandora ran XP apps, the security risk would lie in someone getting access to the XP box. Anyone interested in the data could buy their own laptop to view it on.


Giving a pandora to an employee doesn't increase risk because they already have or can buy their own computers/laptops.


At least that's how I see it. EDIT: I somehow missed Kumaki's post where she said essentially the same thing.

 

[Kumaki]

Yes, klapse, that is basically my point.

there is no ADDED risk to an employee with a Pandy...in my business.

This may not be true for ALL businesses.

I wish they would fix quoting so that you can add in another quote.

Like this?

 

Hey, hedwards...when you are quoting another post...do you see that button on the top left? Click it.

Now you can add in another quote.

 

[2bit]

Perhaps business' should refuse to hire someone with access to a smartphone , PDA , computer , or modded game console ( like the original Xbox that is basically a pc )

 

[Kumaki]

My point, exactly, 2bit!

 

[Binky]

Of course it should also be against the terms of employment for an employee to gain access to a computing device without thier employer's express permission.

 

[moxie]

Perhaps business' should refuse to hire someone with access to a smartphone , PDA , computer , or modded game console ( like the original Xbox that is basically a pc )

Well...quite often you are not allowed to access company resources with such a device. Which is kinda the point

 

[TrashyMG]

I got management approval to use my handheld computer.. aka the Pandora.

 

[hedwards]

Seems to me that the people debating with Kumaki are missing her point: The pandoras isn't a risk to her SPECIFIC business. The pandora doesn't give anyone access to the patient data on the XP box. Even if the pandora ran XP apps, the security risk would lie in someone getting access to the XP box. Anyone interested in the data could buy their own laptop to view it on.

Giving a pandora to an employee doesn't increase risk because they already have or can buy their own computers/laptops.

At least that's how I see it. EDIT: I somehow missed Kumaki's post where she said essentially the same thing.

I've got better things to do with my time than argue this.

But, it's complete bulls**t to suggest that adding a new type of a device which the IT department doesn't have their own copy of and likely isn't going to have a list of vulnerabilities to isn't going to increase the risk because there are other computers on the network.

I'm curious how many other people here actually have any computer administration experience, because adding a new device into the mix always increases the risk of exploits. It's another unit that has it's own set of possible vulnerabilities and it's another unit that has to be patched and uses another method of patching. It's another place where crackers can gain access to materials.

Considering all the hubub recently about USB sticks carrying viruses into utilities, I would think that people would know better to claim this sort of ignorant, "this doesn't increase the risk because they already have computers" it's nice sometimes to be naive, but businesses not taking this sort of thing seriously is why my contact information is all over the internet.

 

[Kumaki]

Of course it should also be against the terms of employment for an employee to gain access to a computing device without thier employer's express permission.

That kinda goes without saying.

 

[overgauss]

If a pandy provides more risk than any other wifi enabled linux/android/windows device then I'm going to go ahead and argue that there's a fair amount of crappy IT security involved.

 

[2bit]

^^ Fair enough . Also where'd your wall o texts go ? I can actually speed read ( and do often when I have the energy , wish I could speed type though ) I found them amusing .

 

[overgauss]

I had to learn how to meter my bandwidth.  However, once the tarzan death grip on my boys start up again, no warranties are expressed nor implied.

 

[2bit]

^^ ... Wait typing uses bandwidth ?!

 

[Neelix]

Any data transferred uses bandwidth,  which includes the text and graphics of every web page you view,  including every time you load page of these forums to read a new message.

When dialup modem speeds maxed out at 28.8kbps (and that was expensive) people generally respected that, and kept things like quoting to the minimum required to get the point across.  These days not so much.

As someone who has had to wait more than half an hour for an 800k mail download (compressed text  for offline reading) on a 2400bps modem I still have an appreciation of these things.

- Neelix

 

[2bit]

That is nothing . It takes me 3.5 hrs to 5 hrs to download a pnd file through my home pc . Soon to change . Needless to say I'm on an phone typing

 

[klapse]

I've got better things to do with my time than argue this.

And yet here you are.

But, it's complete bulls**t to suggest that adding a new type of a device which the IT department doesn't have their own copy of and likely isn't going to have a list of vulnerabilities to isn't going to increase the risk because there are other computers on the network.

Nobody is making that claim. You are taking a statement about Kumaki's specific case, where there is no corporate network to which a pandora would be connected, and rewording it to be a general global statement about the risk of adding devices to a network.

That is straw-man argumentation, imho.

 

[2bit]

Odd , I JUST read about straw man .


Please stop this arguement , under the grounds any reasonably tech savvy n'er gooder could do a bit of damage using everything but the kitchen sink .

 

[Kumaki]

And that is just my point, 2bit.

There is no additional risk to the Pandy, because a ne'er-do-well person could do just as much damage with countless other devices they could provide for themselves...and probably even more. The Pandy just simply isn't powerful enough to run the software we use at any useable speed. The Pandy's applpication in my business is the side/peripheral stuff it can do.

 

[Neelix]

The Pandy just simply isn't powerful enough to run the software we use at any useable speed.

You've said this several times. While I have no doubt this statement is true, the statement is completely irrelevant in the context of a discussion about security.

Put simply, you don't need to run a piece of software to steal or corrupt or manipulate the data it works with, and the Pandora is more than capable of running the tools necessary for such tasks.

- Neelix