The Need for Control

Generally, the recommended strategy is to control the threats rather than trying to totally eliminate them. While some of the threats to endpoint security, such as unauthorized peer-to-peer file sharing, can be eliminated from corporate networks, others (such as wireless and USB devices) are pretty much necessary for modern business IT.

According to Kolter, the first step in securing endpoints is to establish policies on what is allowed and what isn't. "Set the policy according to the DNA of the organization," he advises.

"The ultimate decision needs to be made by the individual organization," says Centennial's Piwonka. Often, this process has to involve users.

"There are businesses out there who might say there is no business reason for anybody to use any removable storage device. The reality is, the minute you try to make that policy, someone will point out that there is a legitimate business reason. How does the marketing department create images? What do your executives do if they need to share financial presentations with business partners and analysts?"

The solution is to make nuanced policies rather than flat prohibitions. You can say that only these types of devices will be used, or only these people will have them. You can also specify devices, different levels of encryption or whatever else is necessary.

Once you have policies, the next thing to do is plug the obvious security holes. Then, publicize your use policies and monitor your network to make sure the policies are being followed. In most cases, this will require software to enforce the policies.

However, the first step, as always, is awareness of the risk. That is coming. "We're finding companies are realizing they have an exposure," says Piwonka, "and it's becoming more of a top-of-the-mind problem."