Triodos Bank Controls USB Risk with DeviceLock«
Triodos Bank was opened in 1980 in the Netherlands by a few visionary thinkers who believed that a bank focused on socially responsible investing would contribute to a healthier, more sustainable economy.á It attracted depositors and investors interested in financing only enterprises that add social, environmental and cultural value in fields such as renewable energy, social housing, complementary health care, fair trade, organic food and farming and social business. Today, Triodos Bank has grown to an institution of 250 employees, working in five locations in four countries, the Netherlands, United Kingdom, Belgium, and Spain.á Many of its investments are found in the developing economies of Latin America, Asia, Africa and Central and East Europe.
Triodos' reputation for visionary thinking is even reflected in its Information Security Management Policy. Like IT managers in all banks and financial institutions in Europe, Triodos' Systems Information Analyst, Willem van de Meent, follows ISO 17799 guidance and regularly undertakes a risk assessment to evaluate threats to the information system and their respective impacts to the organization.á In the risk assessment of early 2004, he considered many potential security breech scenarios, but when he considered both their severity and their likelihood of happening, securing USB ports at local end-points came out a top priority.
According to M. van de Meent, "It is so easy for people to unintentionally compromise security via the USB port.á We made this a top priority, though we want to control the use of other device-level risks as well."
When Triodos Bank looked at ways to close the USB security hole, they settled on DeviceLock« from Smartline Inc. "DeviceLock was the software solution that best met our needs," said M. van de Meent.á Regarding the implementation of DeviceLock« across the 170 desktops and 80 laptops running Windows 2000 that M. van de Meet manages, he comments, "We had no significant problems implementing DeviceLock. True, people don't like to have their freedom limited when it comes to connecting devices through the USB and other ports of their PCs; but, our employees accept that it is a security necessity."