The recently published National Digital Economy Strategy, prepared by the Australian Government Department of Broadband, Communications and the Digital Economy, defines eight digital goals. One of these digital goals aims to increase the teleworking participation rate from 6% of the working population to 12% by 2020. Teleworking is a term used to define the work practice involving remote computing conducted predominately from homes and occasionally from organised telecentres. The use of mobile devices to perform work in transit is also sometimes referred to as telework. Teleworking has a number of distinct advantages for both employee and employer. The employee benefits from reduced travelling time and travel costs, and possibly the opportunity to have flexibility for when the work is to be performed. The employer benefits from reduced office space and attracting talented personnel that would not otherwise be possible due to these individuals not being available to commute and/or work standard business hours. Teleworking can also deliver national economy benefits and improved productivity through reduced traffic congestion, reduced infrastructure maintenance and reduced carbon dioxide emissions.
Australia presently lags internationally in levels of teleworking. With the increase in Internet bandwidth, teleworking has grown more rapidly in countries like the UK and USA where it is not uncommon for organisations to offer a telework option to staff. The UK in particular has a long history of teleworking. In the 1980s companies like FI Group (now part of Steria) and ICL (now part of Fujitsu) both established teleworking divisions to enable staff, predominately female, to remain in the workforce and perform software development from home. A good example of an international company utilising teleworking was Sun Microsystems (now part of Oracle). From the late 1990s Sun Microsystems identified the opportunity to accrue the benefits of teleworking for both the company and its employees and restructured its workforce through the ‘Open Work’ program. At one stage over 20,000 employees were teleworking part-time or full-time. There are some notable examples of Australian organisations that have more recently implemented teleworking; these include iiNet (Australia’s second largest Internet service provider) who has over 150 call centre staff working from home, and the Queensland Government that allows public servants in some agencies to telework.
Organisations often cite managerial control, satisfying workplace health and safety legislation, team communication and insurance as issues during the implementation of teleworking initiatives. Information security, albeit an increasingly important business activity, has traditionally received less attention during the planning of a teleworking project. However, once information security is recognised as an issue a teleworking project can become delayed until appropriate policy, controls and technology are implemented. This article will identify the information security issues that need to be considered and how these issues can be addressed to protect sensitive information and enable secure teleworking.
Despite the existence of large teleworking communities in some countries, little published research is available on the consideration given to information security risks. One of the few notable surveys was performed by Brunel University in the UK. The university investigated the application of information security policy and technology by organisations that allowed staff to telework. The survey found many organisations were unaware of the information security risks, with only a few organisations having a comprehensive understanding of the information security vulnerabilities present in teleworking environments. The organisations that did understand their exposure had implemented a combination of work practices and technology to counter the identified information security risks.
Organisations that process highly sensitive information often prohibit teleworking. Implementing a teleworking arrangement carries with it a heavy burden for both the teleworkers in these organisations and the managers tasked with the responsibility for information security. Managing the risk of information security breaches in remote locations is heightened because components of the security layer, such as physically secure offices and secure networks, are either missing or must take into account additional sources of risk. Disallowing teleworking or restricting information processing facilities would be counterproductive – security must be seen to be an enabler, not a barrier, to business.
The primary information security risk, considered by organisations planning to implement teleworking, is a breach of data confidentiality over the Internet. Established and proven solutions using encryption technology (e.g. virtual private networks and hypertext transfer protocol secure) protect against a breach of data confidentiality over the Internet. However, lack of physical security in remote locations (compared to a corporate office) and the data processing actions of PC operating systems and applications can result in information security risks that are not always apparent to organisations. These risks include:
• Introduction of Malicious Software (Malware): Personal and home PCs are outside an organisation’s control and therefore may be used by any number of people other than the teleworker (e.g. members of the teleworker’s family) who could perform a range of activities that may compromise the PC. Such activities may lead to the PC becoming infected with malicious software which could exploit sensitive data processing and network transactions performed by the teleworker.
• Reduced Security: Logical and physical security for each PC will vary between teleworking locations and is unlikely to meet the stringent security commonly in place at office locations. Weaker logical security may make the PC vulnerable to unauthorised access, network and malware attacks. Weaker physical security may make the PC vulnerable to unauthorised access, tampering, theft or damage.
• Sensitive Data Remnants Remaining on a PC: The PC operating system and software applications will store temporary data in the form of virtual memory and temporary files on the PC’s hard disk drive. Much of this data will remain on the drive after the teleworker has finished work and powered-off the PC. Such data can be readily retrieved through the use of freely available data retrieval/computer forensic tools; a concern if the PC is stolen or if it is disposed of with the hard disk drive still resident in the PC. Additionally, some teleworkers may work closely with strategic partners and utilise PCs at the offices of these partners to connect to the teleworker’s secure company network. After accessing the secure network remotely a teleworker may inadvertently leave sensitive data remnants on the strategic partner’s PC.
• Use of Unsecured Portable Storage Media: Teleworkers need to commute to their employer’s offices where they may also wish to transfer sensitive information onto or from portable storage media whilst having access to the organisation’s secure network. Portable storage media may be lost or stolen in transit resulting in a possible breach of data confidentiality. Additionally, the portable storage media may become infected with malicious software when used in the teleworking environment. The malware could then be transferred to the secure network when the portable storage device is plugged into a networked PC.
• System Integrity: The integrity of the PC operating system and applications used for teleworking may be affected by accidental or inappropriate actions of the teleworker causing a denial of service and resulting in lost productivity.
These risks require a new approach to the provision of a computing environment for teleworkers. A solution is required that will help assure teleworkers and their management of the security of their information, whilst at the same time imposing minimal procedural overheads. Cumbersome non-technical security solutions are, typically, the weakest link in information security and the cause of many of the more embarrassing breaches of security. A mechanism, employing the concepts of secure portable execution and storage, is required which will mitigate the aforementioned risks, whilst imposing minimal additional burden on users.
A secure portable execution and storage environment is characterised as a portable device that connects to a PC through a USB or eSATA port. The secure portable execution and storage environment provides both secure storage and a secure hardened execution environment that can be uploaded on to the host PC to enable secure remote computing. The device contains a range of security features to protect against unauthorised access and attempts to attack and subvert the device. The objective of the device is to provide a high degree of confidence that neither the device and hardened execution environment nor the data processing will be compromised. A secure portable execution and storage environment provides security enforcing functionality and is an ideal computing environment for teleworking because the device:
• Ensures there is only authorised access to the computing environment used by the teleworker. Such an approach must not restrict access to a PC, particularly if the PC is furnished by the teleworker rather than the employer.
• Protects the teleworker’s execution environment and any stored data when left unattended.
• Prevents temporary data and data remnants residing on the PC used by the teleworker.
• Protects the confidentiality of data stored on a portable storage device if the device is lost or stolen.
• Prevents temporary data and data remnants residing on a strategic partner’s PC, when the PC is used by a teleworker.
• Protects the integrity of the operating system and applications that form the teleworker’s computing environment.
Secure Systems has developed the Mini Silicon Data Vault (Mini-SDV), a secure portable execution and storage environment that provides a secure computing platform for teleworkers. The Mini-SDV implements the security enforcing functionality outlined above and also provides a large solid state storage capability. The Mini-SDV provides functionality to counter the aforementioned risks:
• Introduction of Malware: Through the use of the Mini-SDV’s secure partitions, access controls and a hardened execution environment the teleworker can use any available PC to perform secure computing. As the uploaded hardened execution environment only uses the host PC’s RAM and CPU and does not need to utilise the PC’s hard disk drive (HDD), any malware present on the PC HDD will have no effect. The secure partitions and access controls of the Mini-SDV protect the integrity of the hardened execution environment and therefore any malware introduced from the Internet will have no or limited effect.
• Reduced Security: To limit logical attacks the Mini- SDV provides:
– strong authentication to prevent unauthorised access
– access controls to enforce need to know
– encryption to protect the confidentiality of data stored on the device; and a
– secure hardened execution environment that reduces the opportunity for malware attacks.
The Mini-SDV is a small highly portable device that can be conveniently carried and/or secured by a teleworker. The authentication, access controls and encryption counter weaker physical controls and protect against unauthorised access, tampering and theft.
• Sensitive Data Remnants Remaining on a PC: The secure hardened execution environment writes all temporary data, including operating system swap files to the Mini-SDV, thereby ensuring no sensitive data remnants are stored on the host PC HDD used by the teleworker.
• Use of Unsecured Portable Storage Media: The Mini- SDV provides full storage encryption to protect the confidentiality of data. If the device is lost or stolen unauthorised access to data is not possible.
• System Integrity: The Mini-SDV provides mechanisms that will protect the integrity of the secure hardened execution environment from accidental teleworker actions and limit the opportunities of malware exploitation.
An increasing awareness of the benefits of teleworking to both employers and employees coupled with targeted support from the Australian Government is likely to result in organisations allowing staff to telework. However, security conscious organisations taking a holistic approach to information security may deny employees the opportunity to telework due to the vulnerabilities discussed in this article. Security must be seen as an enabler to teleworking not an inhibitor. A secure portable execution and storage environment, like Secure Systems’ Mini-SDV, is a solution that counters the vulnerabilities present in the remote location and enables secure telework to be performed.
