Why Digital Workspace Security Policies Matter as Data Breaches Mount

For any organisation, data is among its most valuable assets, and it deserves the same protection as anything else of value. When a security incident hits, the damage can include downtime and disrupted operations, direct financial loss, and harder-to-measure harm to the brand and its reputation.

Such incidents affect individuals as well as companies. Two well-known examples are the leak of compromising celebrity photos from iCloud and the leak of Malindo Air customer data. In neither case did investigators trace the cause to a weakness in the underlying technology: not in Apple's iCloud infrastructure, not in Malindo's own data systems, and not in those of its cloud provider, AWS.

Passwords and former staff, not broken systems

Organisations pour millions into protecting their data, so the regularity of these incidents raises an obvious question. The investigations gave the answer. The iCloud leaks came down to weak passwords and password reuse. Malindo Air was hit by malicious insider threats: two former employees.

Both point to policy. Staff in a modern workspace use several devices, from notebooks issued by the company to phones and other personal equipment brought in under BYOD. That leaves every organisation with practical questions to settle. Should users be forced to choose passwords of a certain complexity? How is such a rule enforced, and how is compliance audited? And how many separate passwords, for how many applications, is each employee expected to memorise?

Password fatigue is a genuine problem. People asked to remember too many passwords find workarounds, and a common one is a written list of them left in plain view, stuck to a monitor for convenience.

The Malindo Air case shows that a breach can happen even where policies appear to exist. It leaves two questions: why could people who had left the company still reach critical information, and why was their access not withdrawn when their employment ended? In many firms, employees rely on a range of applications, and during onboarding the person in charge in each department may set up accounts and passwords for them. The difficulty comes at departure, when every one of those accounts, and the sensitive applications and data behind them, must be shut off.

Policies, procedures and audits

In the digital workspace, protecting valuable assets therefore starts with a clearly defined and thorough security policy. That policy needs procedures behind it and regular audits to confirm it is being followed. Regulators are raising their compliance requirements, or at minimum publishing guidance on information security management. Many SMEs are not directly bound by these rules, but some of their customers, such as banks and listed companies, may insist on compliance as a condition of continuing to work with them.

Most, if not all, large enterprises and multinationals already have security policies. SMEs find the task harder, because they have fewer resources, tools and skilled staff, and less access to consultancy help. Templates and frameworks are now widely available, though, including those devised by NIST, which can guide an organisation in lowering cybersecurity risk and in managing both cyber supply chain risk and insider risk.

Where VMware Workspace ONE fits

On the tooling side, the article points to VMware Workspace ONE as a way to give employees a secure digital workspace. VMware presents it as a simple, secure platform that adds visibility over how IoT devices are used and accessed, which can help an organisation cut its exposure to threats considerably. It also lets IT administrators deliver and manage applications quickly, securely and at low cost.

The Standard Edition is sold as a SaaS subscription, with a minimum of 25 users, at under US$4 per device per month. It covers the basic device and application management a business needs as data security becomes more complicated and demanding. Because it runs in the cloud, there is no need for a large, expensive investment in IT infrastructure.

Higher tiers such as the Workspace ONE Enterprise Edition add further security and features, including email and content management, application delivery and virtual desktop infrastructure.

This article was sponsored by Net One Asia, an IT managed service provider whose end-to-end offering includes basic IT information security policies, implementation of VMware Workspace ONE in line with those policies, and managed services to run the environment, covering onboarding of new employees, patching of devices, operating systems and applications, and offboarding procedures for staff who leave.