WHY IT MATTERS: Digital Transformation

Last month’s story about organizations exposing passwords and other sensitive data via collaborative online spaces at Trello.com only scratched the surface of the problem. A deeper dive suggests a large number of government agencies, marketing firms, healthcare organizations and IT support companies are publishing credentials via public Trello boards that quickly get indexed by the major search engines.

5 key recommendations

1. Don’t reject BYOD — be prepared for it. Give your IT administrators actionable data on device ownership and health that can inform risk-based access control decisions.
2. Encourage safe computing practices and good security hygiene, such as running regular security updates or using device encryption, passcodes and additional authentication to protect systems and data.
3. Configure systems and deploy policies that enable automatic updates for as much software as possible to remove some of the friction that users feel when manually installing updates. We found that an overwhelming number of out-of-date browsers and systems don’t take basic steps like enabling automatic updates.
4. Switch to browser platforms that update more frequently and automatically, like Google Chrome.
5. Disable Java and prevent Flash from running automatically on corporate devices, and enforce this on user-owned devices through endpoint access policies and controls.