Un-Trusted.Net

I have.

In fact, I have lugged three laptops through four airports in three days.

It wasn’t fun.

And if I had my preference, I would never do it again.

But what does this have to do with untrusted systems? Bear with me for a few more paragraphs…
 

How many personal computers does one person need?

Most of the people I know (and granted this tends to be a pretty geeky crowd) maintain and use no less than two laptop computers.

They own one, which they use for their own personal pursuits. And they have one that’s been assigned to them by their employer, which they use for the work they do for that employer.

And sometimes people (like me) may have a work-related need for yet another separate laptop (or even more), which when combined with work requiring travel can lead to airport adventures like mine mentioned above. (I know – it’s a silly state of affairs.)

 I have recently made it my goal to reduce this to one single personal computing device (not including smart phone, which is a matter for another post). I want to own and operate (and secure) my own mobile personal computer, one single physical device to serve all of my networked computing needs.

And then when some other entity (such as my employer or a client) needs me to use a computer that is configured and managed to their specifications by their IT personnel, that computer will simply run in a virtual machine on my own computer.

For a guy who has been caring for three (sometimes four) laptops…this would be Nirvana.

I was beginning to feel that I was the only person in the world who wanted such a thing, until I read Stephen Shankland’s article Get ready for virtualization to affect you, too, yesterday on CNET, in which I’ve had my first encounter with the term “employee-owned IT”. Apparently I”m not alone.

Can your employer trust your computer?

As a person whose life revolves around computing, I love this idea, and I want it in the worst way. However, as an Information Security professional, I’m also painfully aware that there are significant obstacles to be overcome.

For most organizations, and especially those that are conscientious about information security, employee-owned hardware definitely falls into the classification of untrusted system.

So what do you think?

If you’ve ever had to juggle multiple laptops, does the idea of running your employers “blessed image” in a virtual machine on your own personal laptop appeal to you? Have you ever asked for this and been turned down?

How much in the way of “requirements” would you be willing to put up with? What if your employer wants to periodically or even automatically “audit” your security configuration?

If you’re responsible for information security in an organization, does this notion have any legs at all?

Is there a way to establish trust in an employee-owned laptop as a vm platform on which to run your organizations secured systems? What would it take?

If you’ve already gone down this path, how did you get there?

:: :: :: :: :: :: :: :: :: :: ::