A week or so ago amazon asked its employees to remove TikTok from their
devices only to reverse their decision just a
few hours later it begs the question is there an
enterprise security risk around tick-tock stick around
hey everyone welcome back to today in tech I'm Juliet Beauchamp
and i'm here with eric noonan the ceo of cyber sheath and a cyber security expert
eric thank you so much for calling in and joining me today juliet thanks so
much for having me looking forward to this a very uh
timely topic i think this is such an interesting
discussion and i've been seen as i'm sure you have and as
as i'm sure our viewers have i've been seeing you know
alleged security concerns around tick-tock and privacy concerns around
tick-tock for a bit for any of our viewers who may
not know it's a little bit similar like um the app of
vine which when which was owned by twitter and now
no longer exists but it's basically a platform where
users can post 15 second to one minute long videos
there's a lot of dances that happen you know there's comedians it's sort of a
whole a whole buffet of options if you will on
tick tock but right now i think a lot of companies are
wondering if there is an enterprise security risk
related to it so first i'm wondering what is the alleged risk and privacy
risk around tick tock and should csos and csos be concerned
so i think julia first of all um absolutely there is potential for risk
it's not unlike the risk that you've you've
already accepted as a cso or anybody in that kind of a security position for a
large enterprise that you have with other social media apps right so whether
it's facebook twitter whatever it is there's a privacy component and then
there's a legitimate and somewhat unique security component to
the risk with tick tock because of tick tocks corporate
ownership which is uh based and headquartered in
china and owned by china and obviously that's the unique
concern more than anything with this particular app
so i'm wondering i mean you mentioned that
the chinese ownership is perhaps the cause for concern so is that what makes
it different than the privacy concerns around
you know what other apps your employees may have on their phone anywhere
anything from their weather app to facebook google whatever
no it's a great point so the weather apps and all those data collecting apps
uh they're obviously a privacy concern the unique thing here is you have all
those privacy concerns but then you have the requirement of a
chinese-based company to cooperate with the government of china and and the
access that the government has to that data so
if you tie a few different threads together on the security
front i mean the privacy thing i think is at least equal to the concerns you'd
have with other apps but if i'm a cso uh particularly if i'm a chief
information security officer with any any company that is part of the defense
industrial base which when we think about that uh you might
think department of defense but really that's 300
000 plus commercial companies around the world
and so if i'm a cso for an organization like that a commercial organization the
security concern is based around the information that's
collected and then that potentially could be
aggregated with other information uh that that china has
allegedly already collected collected with the
office of personnel management hack from several years ago
and other large data breaches so unlike that weather app that you
you referenced with that maybe has your location and some other information
now the concern is with these other breaches could they take the information
that tick-tock is collecting from a privacy
perspective much like other social apps and then aggregate that with other data
to potentially uh use it for malicious
purposes and that's really the security angle in the story
yeah so i'm curious if you could just sort of you know
walk me through a perspective of a cso or a cso who may be considering
whether or not banning this app is appropriate could you walk me through
what exactly what kinds of data tick tock is collecting and how it could
expose your company sure so i think that's a great question so
as a cso and having been a global cso for a
large company hopefully you already have a policy around social media in place so
what i think you can't do as a cso is start running to all these
brush fires and trying to fight them all individually hopefully you already have
a framework and a policy for social media and bring
your own device and all the elements that contribute to
this particular risk and you're not trying to reinvent policy
for every new app because you'll just never catch up
so the way that i would approach this would be to look at our existing social
media policy see if this particular app tick tock
still fits into that box because you've probably already put a
lot of work into that as a see so you've pulled together the stakeholders be it
legal you know be it the business owners
marketing and all the different stakeholders to create that social media
policy so the first thing is to look at this app through the filter of
the policies you already have and then evaluate it that way and then
that brings you to a bunch of other concerns right around bring your own
device and and who issues the device is it the
company that issues the device is it personally owned devices
and that's going to take you down a few different roads but but i don't think
you look at the app in a vacuum and just the app you need a
larger framework to to use as a filter and a context as a
cso sure and i'm wondering too about
tick tock's perspective i mean for what it's worth the company has said over and
over again that these claims against it are not true
so allegedly if you could walk me through
how tick tock or its parent company could benefit from
the data of your employees what what does that look like sure so again
allegedly and i think that's a key term right so you can get very conspiratorial
and and come up with a lot of different theories but
for cso uh you don't have the benefit of doing that right you have a job to do
and you need to first is there a use case for this app
in your business and then you look at it through the filter of the social media
policy and you make a decision so uh tick tock's done a lot of things
to try and reassure users enterprise users so they've said
the data is housed in singapore in the u.s they've recently appointed
a u.s uh ceo uh they've said they will not share data with china they have not
shared data with china so from that perspective
they said the things you would expect them to say
but the ultimate risk that you can't really quantify
is the chinese ownership so i think with any risk
as a cso you have to look at this in the risk-reward perspective and
say does my business need this is this going to cause
some disruption to my business if i don't allow it and if i do allow it how
do i do it in a way that mitigates that perceived risk got it and i think so
often i hear and understand and it's true that
you can't ever be 100 secure you cannot eliminate
all risk but a lot of security in cyber security practices is just about
mitigating that risk so i'm wondering too
how this relates to employees i mean if i'm an employee of a company and i have
a company-owned device you know iphone android phone whatever it is
obviously it seems intuitive that that company can pretty much
tell me to keep or not keep whatever they want on that device
but i think the line starts to blur a little bit when it's an employee-owned
device and an employee might look at this and
say my personal phone has no relation to the
company that i work for beyond the fact that it's
mine and i work there so first of all how enforceable
would this sort of policy be and if an app is on an employee's personal device
and not a company device is that less secure is that more secure
or less of a risk more of a risk sure great questions and all
i think questions that ciso struggle with every day because it's uh it's just
the reality of the world that we live in today
and so i think two use cases right so here at cybersheet the large number of
our customers are within the defense industrial base so in that side of uh
the uh the user base that potentially would be using tick tock
the government has banned that app the department of defense said you're not
going to use it on our devices so company-owned devices it's easy it can
be done with policy technical controls so that's very easy
to control and mitigate and not allow and enforce obviously on a
personal side it's much more complicated so there's
technologies that allow you to kind of segment the
company data with on your personal phone and your personal data and keep those
two data spaces separate so that would be a best practice and a way to
potentially allow access to the app on the personal side of that personally
owned device and still segment and encrypt and protect the company data
on that personally owned device so there's technical controls for that but
ultimately as you said if it's a personally owned employee
device that employee probably ultimately has the authority and potentially that's
again back to policy i think everybody would love a technical
solution to this where you can flip a switch and
you can mitigate the risk but it doesn't exist and policy and training
don't get as much uh kind of headlines and talk as
as they probably should but this is a policy and training issue and so
training employees that if you have a personally owned
device and we give you the ability to access company data on that device
there's parameters for how you have to behave and that's a policy and training
issue and that's the best way you can probably enforce it
i'm wondering too how any sort of company policy around tick tock i know i
said earlier amazon reversed his policy but then
wells fargo came out and said that it was banned on their
company-owned devices i'm wondering how this could shape
byod policies going forward do you think that this is a fantastic
time for enterprises to sort of overhaul their social media policy or is
this going to just be something that's taken on a case-by-case basis and
how overreaching can a company be when it comes to employees personal devices
i think employers have a lot of latitude with
how and ultimately control on how and who they allow to access company
infrastructure now it does get blurry with the personal
device but you know you reference amazon and wells fargo
those are large companies with well-funded i.t security teams so even
if the decision was rescinded a lot of thought went into that and that
memo that was released and redacted in the amazon case
it was drafted and thought through for a reason so there's something behind the
thinking and i think smaller enterprises and cso should look
at that and consider the fact that there is risk whether it's real or
perceived i don't think anybody can fully quantify that
yet um but but ultimately the what the the cso's obligation is is to the
company and so i think it can shape byod policy
i don't think it's kind of a watershed moment i don't think it's significantly
different than the privacy risks that we've all been living with for
years with social media apps so again i think it fits within an existing
framework around how you're going to allow users
to interact with social media and the guidelines you create for them how you
train them how you make sure that they're accountable for that behavior
i think it all fits into that context it's less of a watershed moment more of
a this is just the next thing that should
fit inside the policy and the processes that you hopefully have already had in
place and i just am curious about one more
question before i let you go you mentioned that whether or not this
risk is real or perceived is still sort of
up for debate perhaps or there's just not enough information available
i think the first thing that a lot of people thought when they saw
that amazon decision was does amazon know something that the rest of us don't
know is there any likelihood to that or was
this just as you said you know a thought out decision
by their i.t team by their security team that ultimately they
decided to reverse well we don't know but you could make the same argument
right for uh the department of defense in
disallowing this right and so our customer base again is largely that
community that interacts with sensitive but
unclassified data controlled unclassified information
and the department of defense as a whole has has made
tremendous efforts with the with some of their security
efforts to really reach out to the private sector
and enforce some level of cyber security the biggest one is the cyber security
maturity model certification and as that relates to tick tock you
could look at that and understand that clearly there is
something that is perceived it hasn't been
quantified publicly but you have enormous organizations like
amazon and wells fargo and the department of defense taking action
and i think any see so in in that in a position to make a decision on this
should take that into consideration and weigh it pretty heavily
fantastic well thank you so much eric for your insight i think this is
really helpful information it can maybe help our viewers decide whether or not
you know allowing tick tock on company devices or personal devices
is a risk worth it to them so i really appreciate you calling in thank you so
much thank you so much juliette it's a
pleasure and thank you all so much for watching this episode of today in tech
if you liked this video be sure to give it a thumbs up
and subscribe to our channel if you have the hit the bell icon in the corner
you'll be notified every time we post a new video if you have any
comments questions about the security of tick-tock or any app for that matter be
sure to let me know in the comments below
thanks again for watching and i'll see you next time