Managing Computers in Large Organizations

Managing Microcomputers in Large Organizations
http://www.nap.edu/catalog/167.html
About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the
original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be
retained, and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution.
MANAGING MICROCOMPUTERS AND END-USER COMPUTING SOME CRITICAL
ISSUES
greater concern is warranted. When thousands of people are accessing sensitive
corporate or agency data, the probability is that someone will remove
competitively sensitive data on a floppy disk. A floppy disk is convenient; it is
easy to transfer data to it; it can hold hundreds of pages of data. A person can
walk out of a building with it unobserved. The contents need not be identifiable
externally. How does a security guard know what is on one?
There is also the well-publicized problem of illegal access by telephone.
Since solutions to this kind of unauthorized access are known, the problem falls
into the administrative area. It should be possible to detect and trap
unauthorized dial-in access.
Access to a computer system is possible not only directly through the
normal log-on process, but also by tapping communications links and by
removal of media such as floppy disks. To eliminate loss through these means
some form of encryption is required to protect the data even when the media are
compromised, or to make decoding so expensive that potential thieves are
dissuaded.
These measures are expensive, as are any security measures. To justify
them the potential loss from a security breach must be greater than the cost of
the security measures. The organizations we have worked with limit their
security measures to password systems. Some depend only on the log-on
password; others have protection at the file level, so the end user must know
two or three passwords. A few have additional password protection at the
operating systems level. I know of no commercial firm that uses encryption in
relation to the kind of end-user computing we are discussing. Ultimately, most
organizations depend on a trustworthy work force.
Microcomputers are removed from the direct control of the mainframe,
and therefore are not guided by data processing standards. Does the use of
micros create additional security problems? To answer this we must distinguish
between external and internal breaches of security. In terms of external attempts
to invade the system, it seems to me that micros do not add problems.
Physically locking the micro and any removable media may be necessary in
some cases. However, data down-loaded to a micro is not at greater risk than
data printed out, or data put on a floppy disk, or microfiche, or any other
removable media. In relation to internal security leaks, the micro, as a powerful
information processor, may provide opportunities for access and removal
88
Copyright © National Academy of Sciences. All rights reserved.