What IT security lessons can teenagers teach the enterprise?

Kids using tablets and smartphones

I've been involved in IT security for twenty years now, and you'd think - as a result - my teenage son would be mindful of such matters. But you couldn't be more wrong.

My lad has absolutely no security smarts, despite my efforts, and his mistakes are all too often mirrored in the corporate world. The consequences, however, are a tad more serious than someone posting embarrassing messages on Facebook. Let me explain.

Data sharing is the main problem I have with my teen. He signs into his social media accounts on someone else's device, and forgets to logout when he passes it back.

He thinks nothing of leaving the family laptop running for 15 minutes or more while his social media accounts remaing logged in.

Unsurprisingly, this has resulted in his mates, his girlfriend and me posting stupid things under his name using his account. Worse still, he also uses the same password for his social media, laptop, and his Xbox account.

In this, he's not alone. New consumer-focused research from Kaspersky Lab suggests 32 per cent of people take absolutely no precautions when letting others use their devices and 92 per cent store sensitive information on them.

Those numbers also sound about right for the business sector. At the smaller end of the enterprise scale, device sharing is pretty common and adequate security measures are not. As you move up the curve towards larger enterprises, things improve as far as device security goes, but the sensitive data issue remains.

It's all tied into the whole Bring Your Own Device (BYOD) problem, of course, and how to control what data is allowed where, who can access it and when.

Although the BYOD has been done to death, there remains a problem whereby shadow IT exists within the enterprise and a data-centric approach to security is not in place to help mitigate the threat.

How does this tie into my teenage son's device misuse? Well, unless you get to grips with securing data itself, then users of devices will remain the weak link in your strategic security chain.

You cannot control who uses a personal device once it is out of the workplace, and you cannot control what users do with it.

If you don't get serious about data security, rather than device security, you are heading for a fall. My son, on the other hand, is a lost cause. Luckily, he has no data of any value whatsoever. I know, I've seen his Facebook feed.

Davey Winder

Davey is a three-decade veteran technology journalist specialising in cybersecurity and privacy matters and has been a Contributing Editor at PC Pro magazine since the first issue was published in 1994. He's also a Senior Contributor at Forbes, and co-founder of the Forbes Straight Talking Cyber video project that won the ‘Most Educational Content’ category at the 2021 European Cybersecurity Blogger Awards.

Davey has also picked up many other awards over the years, including the Security Serious ‘Cyber Writer of the Year’ title in 2020. As well as being the only three-time winner of the BT Security Journalist of the Year award (2006, 2008, 2010) Davey was also named BT Technology Journalist of the Year in 1996 for a forward-looking feature in PC Pro Magazine called ‘Threats to the Internet.’ In 2011 he was honoured with the Enigma Award for a lifetime contribution to IT security journalism which, thankfully, didn’t end his ongoing contributions - or his life for that matter.

You can follow Davey on Twitter @happygeek, or email him at davey@happygeek.com.