What are your strategies for encouraging customer adoption of IT security measures?
It's hard and complicated to figure out who's a covered insider, who needs access and who needs full access. It does take work, but the impact of not doing that work is that you have critical people who generate revenue for the business that can't do their jobs. And what happens is, people will find another solution. They'll store the data somewhere else, which just creates another problem. So you have to do that extra work, sometimes there just isn’t an easier path.
Denying admin access to users on your machine is another simple strategy—in certain organizations, they just say, "No, admin access is not needed." But in our case, we do give users admin access because otherwise it would prevent them from doing a lot of things on their laptops. And now we have other protections like MFA and so on.
So the second part of my approach is to give them the best equipment they can use. If I give you the latest Mac with the M1 chip, a fancy camera and all that, what is the likelihood you will use your own laptop to do any work? If I can get into your head to force you down this path, without having to be in front of you saying, "No,you need to do everything on your laptop." It's like a forcing function—you'll use it because it's just better equipment, it's always working, it's supported, all of those pieces. And it's automated, etc The likelihood that you will go off path is very small, unless you’re resigning. Regular employees will stick with what's given to them.
I think that's a great approach. It's like Apple's approach to buying their product: if you make the garden nice enough, people don't care that much that it's walled.
Content you might like
First day on the job10%
Sometime during their first week52%
Sometime during their first month26%
2-3 months after their hiring date6%
It depends on their role/level3%
Other (explain in the comments section)1%
1. Executive Summary
Background: Explain the objectives and risks and reasons the IAM is needed.
Specify the IAM governance scope (e.g., user access to systems, privileged ...read more
API security is our top priority8%
Very high48%
High34%
Medium9%
Low1%
API security is not at all a priority for us1%
Most of the time the legals and or DPO don't have the technical acumen to understand when data is floating to third party services.
Lets ...read more
Back when I was working at Gilead I assigned some basic security functions to one of my system admins, and they’d read a book that said you should put a lockout on any desktop, and make it mandatory so that when it locks out the customer can't reset it. I had sales people coming at me nonstop the next week, because they're in the middle of a meeting when the computer locks out and then they can't reset it. It's often a matter of figuring out how to get around those little things and go the extra mile so that you can still have what you want without rubbing it in the customer's face.