Personal Media Devices: The Cool Threat Vector

This paper discusses the use of personal media devices as a potential threat vector for corporations. The author contends that personal media devices provide an ideal mechanism for smuggling information out of moderately secured business environments based on two observations: First, technological advances in this market sector have surpassed the effectiveness of security controls that are presently in place in most organizations. Second, these devices appear to have one clearly defined purpose; a music device is expected to play music. Therefore, the most effective means to mitigate the risk that these devices introduce is shown to be the prohibition of these devices in the business environment and the implementation of effective security awareness programs in the corporation. In the first section of this paper, the author examines common perceptions that people have of personal media devices in business environments. As the causes of these perceptions are examined, the case for considering these devices as effective threat vectors is established. This is followed by a technological overview of these devices and how these devices can be used in successful attacks. Finally, the author makes recommendations of how to mitigate the risks that are associated with these devices.