Norwich Union locks down removable media

Norwich Union has locked down employees' access to USB memory sticks, rewritable DVD drives and floppy discs on 48,000 desktop PCs, as part of a drive to secure and control sensitive financial and customer information. The initiative, which has added £10 to the cost of supporting each desktop, will help the firm meet increasingly stringent compliance regulations which require financial services firms to secure sensitive customer data.

It aims to protect the company from the potential risks of disgruntled employees misusing sensitive information or staff inadvertently introducing malicious code, viruses or spyware on to the firm's network. "We are talking about price- sensitive information, the impact of viruses, and the potential of spyware. The company, part of the Aviva group, began rolling out centrally controlled software, supplied by SecureWave, to restrict access to removable storage devices as part of its upgrade from Windows NT4 to Windows XP.

The firm ruled out a complete ban on USB ports, recognising that some staff needed them for their work. It decided that staff who need access to USB ports, either to use printers or memory sticks, would have to produce a business case to do so. "We operate a policy of least privilege. By default you get nothing. If you are a call centre operator answering phones and accessing different applications, you get zero control of your PC, whereas if you are a developer, you would expect to have free rein." Norwich Union monitors data transfers into and out of the organisations, and restricts staff to using designated folders to send data. It keeps logs of the transactions.

CATEGORIES : 1mobility, 1data protection, 1removeable media, 1best practices, 1case study, 1endpoint security