US govt staffers use personal gear on work networks, handle biz docs on the reg – study

Simple but bad explanation

Been there, seen that. Did it? Your honor, I plead the fifth.

These people- by and large - are not stupid. They know the policies and risks. But their gear is crap, support is worse, and they are still expected to accomplish their mission - whatever it takes.

You want it done real bad? It will probably get done real bad.

Bet you any other hellhole of compliance-based mentality and mind numbing bureaucracy will be the same. Sad, really.

Security is a pain

Lets be honest, keeping a machine secure at work or at home is generally inconvenient as the requirements will make simple tasks less so (or occasionally impossible). As a result many people will cut corners as they really don't understand the risks.

I've never used my own equipment in the workplace - if my employer wants me to use a computer he can pay for it - and I am sufficiently paranoid never to have picked up a nasty at home. But this is made easier as I don't frequent social media or pornographic websites (is there a difference?) so I am less at risk than some. Also, I very rarely use public wi-fi hotspots and when I do it is from very tightly locked down linux device.

Amusingly, the only time I ever had a problem was at work inside a pretty solid corporate firewall. I had been issued a new laptop and I had to plug it into the office network to pick up the mandated firewall & a/v packages (no pre-installed corporate setup at the time). During that process the thing picked up no less than 6 viruses. IT support tracked them down to a guy who had taken his laptop home and let his kids install games on it ...

Sure is a problem, yup

I'm not employed by the government, but last year's security incident audit identified this issue as one of our site's biggest vulnerabilities. Good! The Specific Vulnerability is an extremely high up Important Person's personal laptop that keeps getting viruses and keeps getting connected to the network. Not Good!

Simon knows what to do.

Instant destruction of device. Bonus BOFH points for making the user wield the hammer themself.

Love to know what percentage were Huawei devices...

"Federal agency"

That can cover a lot of ground. I doubt (well, hope) the TLA agencies are that slack about security, especially post-Snowden, but why would it matter that much for agencies like the US National Park Service or NOOA?

This survey - did Lookout have official sanction to conduct it and did the respondents have clearance to give their answers?

Who needs Huawei?

When your staff are insecure it doesn't matter how good the kit is.

People are fundamental to security

Security depends on the trustworthiness, expertise, and diligence of people.

But any reasonably large group of people will include one who is a defector, stupid, or lazy. That is why secure organizations are organized in small cells.