Case study: VDI as a security measure | BCI

The scenario

An employee was provided a company laptop with a VPN, etc, to securely login to their company’s network. However, a big gap in the security measures was that he was never told to use the network drive, so all data was on his machine. This created two threats:

1. The laptop disk crashing – all data would be lost, as it was not on the network drive and was never backed up. The solution would have been as simple as giving initial instruction during the induction to save files on the network drive. Since a user can forget these instructions, an audit could be done (e.g., monthly) to see if the user has any activity on the network drive. In this case, it went undetected for about 6 months.
2. If the laptop was stolen, the thief could have access to all the data from the laptop disk. In this case, external drives (USB) were not disabled, but data transfer to a USB drive would be encrypted. Is the decrypt key also stored on the USB drive itself? Also, the data on the laptop disk was not encrypted – would this be considered a breach/ lack of control? Due to the costliness of data encryption, did the company think keeping data on a network drive would be enough control?

This employee was then deployed on a client assignment, where they needed access to client systems. As a security measure, the client would enable their access through a virtual desktop infrastructure (VDI) environment on his laptop which would need multiple authentication, etc. The user did not store any files on the network drive for about five months – so there was similar risk to the above case. Sure, the broken or stolen laptop wouldn’t pose any threat to the client’s data, but the data was never backed up. Is there any threat of losing this data?

Later, it was identified that many employees of the client were storing data on their desktops (which perhaps was never backed up) for one simple reason - storing data on the network drive would reduce productivity as it was very slow.

Learnings from the case:

1. Training and awareness is important. ‘No one told me, I didn’t ask anyone’ is a threat to security. While the user is supposed to know or ask, the IT team is supposed to tell (on day one) to use the network drive.
2. If the network drive solution makes the responses slow and brings down the productivity, users will have the tendency to bypass this control and start storing data on local drives.

For this client’s own employees, there was no VDI environment, so files stored on local drives would be lost (in the event of a crash) or would be available to thieves in case of theft. Whether the client had applied encryption on local drives is not known, but most likely not.

So, we are far from a secure world, it seems! Basic principles are important, as is doing what one is supposed to do!

Daman Dev Sood, FBCI, International Resilience Trainer & Consultant