06:04 PM
Connect Directly

New BYOD Threat: Email That Self-Destructs

Employees who bring apps like Wickr to work could bypass enterprise security systems.

People should be more aware of their digital footprint, said Sell. She points out that when you send a message in the traditional way, it's stored on multiple servers where others can potentially see it by accessing or hacking a database. "There's stuff that is easy to get," she said. "And money can buy you crazy stuff about people via the deep Web." At the other end of the spectrum, "criminals are all over the world. If you have money or anything of value, you need to start looking at your digital footprint," she said.

The United States is Wickr's biggest market, but the app is available in 110 countries and is the number-one free social app in Greece, Singapore and South Africa, in the same category as Facebook and Twitter. Sell attributes that popularity to people wanting to have control over private, anonymous free speech. "Private correspondence is important to a free society," she said.

Security expert Dan Kaminsky, an advisor for Wickr, agreed. "Non-permanent communication came first -- humans have been speaking before they have been writing," he pointed out. "Communicating privately ... is core to the experience of being human. People need to be able to express their thoughts and converse with their friends, family and spouses -- and feel secure in their communication."

But Wickr also raises a lot of hard questions about security and regulation. Sell acknowledges that when she works with chief security officers, questions about regulation in the enterprise come up frequently. How will IT leaders manage communications when apps such as Wickr and Snapchat inevitably make their way into the enterprise? Many companies are required by law or regulation to keep records of all communications for many years. These new apps could make that much more difficult, if not impossible.

Derek Schueren, who co-founded data management, governance and analytics company Recommind, helps companies organize and index unstructured data. Recommind uses a technology called CORE that can help enterprises organize their data and make it easier to search and sort.

Most companies have a wide variety of electronically stored information, much of it in spreadsheets, databases, text messages, instant messages, email, file fragments and digital images. In most cases, that information can be searched and specific bits of data can be retrieved, if necessary, to respond to lawsuits or patent disputes or for other reasons. Many companies have policies that specify when certain types of data can be deleted. Other companies try to keep everything for decades.

"You have an obligation [to retain data] if there's a possibility of litigation. This includes email [and other forms of communication]," Schueren said.

Companies might worry about Wickr from a legal perspective, according to Schueren, but a bigger concern may be that Wickr could be used for destructive purposes. An employee could take photos of company secrets or forthcoming products and send them to someone outside the company.

"It used to be files were locked in a cabinet and you knew who had the key," Schueren said. "Now everyone has the key. Everyone has connections to the outside world and companies are more exposed than they used to be."

2 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
2/7/2013 | 2:40:57 AM
re: New BYOD Threat: Email That Self-Destructs
It is interesting how 'end users' are taking 'governance' controls into their own hands this way - as with all tools - good and bad can come from it. I agree with Drew, some of this new technology is moving so quickly now that corporate policies and juristictional laws simply aren't keeping up. Imagine an HR policy on 'self destruct' messaging conduct? :)
User Rank: Apprentice
1/25/2013 | 11:37:38 PM
re: New BYOD Threat: Email That Self-Destructs
Melanie, I agree. The threatening messages could be a problem. People need to be held accountable.
User Rank: Guru
1/25/2013 | 6:52:58 PM
re: New BYOD Threat: Email That Self-Destructs
Not to mention cyber bullying, sending false information with no trace, the slippery slope goes on and on. Visit any forum and you'll see what anonymity creates - a horrible, venomous pit of nastyness, racism and sexism. This will only feed that horrible troll. Sorry, I think the bad outweighs the good in this one.
Drew Conry-Murray
Drew Conry-Murray,
User Rank: Ninja
1/24/2013 | 11:04:38 PM
re: New BYOD Threat: Email That Self-Destructs
I'd rather have tools like Wickr be available to help people protect speech and just accept the risk that these tools present to corporate information. Given that there are already myriad ways to get sensitive corporate information out the door, this doesn't seem to raise the risk bar much higher than it already is. What's really interesting are the legal ramifications of issues like a hostile work environment, where someone could use Wickr to send threatening messages to a coworker. That seems like a more difficult issue.

Drew Conry-Murray
Editor, Network Computing
Melanie Rodier
Melanie Rodier,
User Rank: Black Belt
1/24/2013 | 10:07:25 PM
re: New BYOD Threat: Email That Self-Destructs
There are of course benefits to having self-destruct messages, and it's an interesting concept, but it still seems a little dangerous from a compliance and legal and just from a general 'good citizen' standpoint not to leave any digital footprint at all...What if someone sends threatening messages that self-destruct without a trace? I think there's something to be said for people realizing that any digital behavior can be traced, for better or worse.
Register for Dark Reading Newsletters
White Papers
Current Issue
5 Security Technologies to Watch in 2017
Emerging tools and services promise to make a difference this year. Are they on your company's list?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.