The IT Nerd

Now that major parts of the United States are under stay-at-home orders, unprepared corporations face a huge data control problem as they go into their first major billing cycle carried out by employees working at home, according to the   International Association of IT Asset Managers (IAITAM).

Thousands of U.S. companies are relying on employees untrained in doing their jobs from home and using untracked equipment on insecure Wi-Fi connections.  Not only are these companies putting their own data at risk, but they are also exposing sensitive data about their clients.    Less than two weeks ago, The International Association of IT Asset Managers (IAITAM) issued a warning to organizations and government agencies, urging them to consider “nightmare data risks” before moving to work-from-home arrangements.

IAITAM is concerned that many employees will be ill-equipped on home computers and other BYOD (bring your own device) equipment to handle sensitive data such as credit card numbers, foreshadowing imminent breaches of personally identifiable information (PII). Ensuring that policies and procedures are in place and enforced (including on a remote basis) is imperative to protecting data and the integrity of an organization.Billing information always contains PPI, which is subject to data privacy regulations. It is important to ensure that assets used at home are abiding by internal policies and external regulations that govern billing information. For instance, Payment Card Industry (PCI) Data Security Standard compliance dictates that companies cannot track credit card numbers or duplicate them without appropriate masking. Under these terms, printing an invoice or taking a credit card payment over the phone, and writing it down without redacting full account numbers, could be considered a data breach.

Industry regulations for sectors such as education, finance or healthcare have separate considerations. Additionally, all businesses that handle data from European citizens are subject to GDPR enforcement and hefty non-compliance fines. It is advisable to consult with an experienced IT Asset Management professional, who can appropriately determine which data regulatory guidelines are at work and how to apply them properly.

If you have recently updated to macOS Catalina 10.15.4, you might have seen a prompt like this after the upgrade:

In my case, I got this for the software that drives my Logitech mouse as well as Sophos anti virus. I also got a few calls from clients about this asking what this means for them. Here’s a quick primer.

What this message is telling you is that in a future version of macOS, kernel extensions which are better known as system extensions which enhance the ability of macOS to function will no longer work. If you want to get into the nerdy details, you can get them here. But in short, this is something that dates back to the early days of OS X and then macOS. The problem is that Apple wants to make the operating system more secure. Steps like introducing APFS, and Gatekeeper are examples of how Apple is achieving that goal. And getting rid of system extensions are the next step.

For now you have nothing to worry about. But in a future version of macOS, likely macOS 10.16 this fall, the piece of software that is generating this message will stop working. Thus software vendors need to update their software, and you need to install those updates. In my case, Sophos has a statement about this on their website which states that you don’t need to take any action at this time and an update is coming. I was unable to find any info about what Logitech is doing. Thus I will be sending them an email to find out what their plans are.

I would recommend that you take a note of the software that generates these prompts and reach out to the software vendor in question to find out what their plans are to make them go away. Because if they delay coming out with a fix, the potential exists that software that you might depend upon may stop working as early as this fall. Thus reaching out to them to say that you are expecting a fix for this will put pressure on them  to do something about it now.

Finally, if you want Apple’s official word on this issue, you can find that here.