RSM Resources

Like hikers wandering around a forest without a compass, Internet users would be lost without search engines. Computer users have access to a similar tool to search their desktops.

Computer users traditionally have relied on their own memory or the far-from-perfect search software that comes installed on most computers. Increasingly, they are turning to Google Desktop Search and similar products to find files stored on their hard drives.

Several desktop search engines are available as free downloads. They can track down information stored in e-mails, instant messages and Internet browser history logs, as well as word-processing, spreadsheet and presentation files.

These tools are rapidly gaining popularity, because the ability to find files quickly enhances workplace productivity. "People like it," says Whit Andrews, a research vice president with Gartner, a technology consulting firm. "They feel like they can get their job done better, and that cheers them up."

Despite the productivity improvements these search engines drive, data-security experts worry the widespread use of these tools could pose problems for companies that don’t take a few preventive steps against data theft.

Some firms allow — and encourage — employees to download software on their own as a way of discovering what works best. This organic process has its benefits, but in the case of desktop search software, it could prove troublesome.

One especially problematic feature of desktop search engines could enable users to access their office files from PCs at home, the local coffee shop or anywhere there’s Internet access.That’s valuable if you need remote access to your work files, but it raises all sorts of data-security issues.

The Enterprise edition of Google Desktop Search calls this feature Search Across Computers (SAC). SAC creates a quickly accessible index of all the documents, e-mails and instant messages, including potentially sensitive information, on the hard drive of a particular PC. Google makes these files available over the Internet by saving an index of user files to its servers. The user and a limited number of Google employees can access this encrypted index for up to 30 days.

While it’s highly unlikely that data from the index could be intercepted or decoded, having that information leave the workplace is problematic. Experts say it could cause a company to lose its proprietary right to that information.

"For a company with intellectual property, [remote access is] not something you want to turn on," says Seth Nielson, a security analyst with Independent Security Evaluators, a Baltimore-based company.

Remotely accessible data could also cause problems if state or federal laws prohibit certain data, such as health-care records or financial information, from leaving the workplace. Even if an employee doesn’t download this data, it might appear on a desktop search from a remote location. That’s a possible legal violation.

It’s also a possible public-relations nightmare. Few consumers would be comfortable with their private information showing up on a remote search by a government or private-sector employee. However, Google has demonstrated that data it stores in the remote index file on its servers is not directly searchable using its Web site.

Safeguarding against improper use of information

To prevent these scenarios from becoming reality, companies should enact a policy that prohibits employees from downloading computer software on their PCs (or at least desktop search software). If firms choose to download desktop search engines, they should turn off any remote-access features.

With remote access turned off, desktop search engines typically index data on a PC, but that data doesn’t leave the PC. The software generally returns results from the Web and desktop simultaneously, but the two sets of information don’t intermingle, meaning sensitive local data remains secure.

Another challenge for firms allowing employees to use desktop search engines is the endof  "security through obscurity." Without desktop search engines, an unethical employee determined to peek at the company’s payroll data might have to search for hours to find the correct file. But desktop search engines can speed up that process considerably. The file might be stored on a single user’s PC, but if that user walks away for a few minutes without signing out, his or her PC is open for quick inspection.

"People can find stuff in seconds that took hours before," Andrews says.

Companies allowing desktop search engines must be careful which files they let employees access. They may also have to force employees to log on and off their PCs more frequently. A two-minute trip to the water fountain is plenty of time to find sensitive data on a co-worker’s computer.

Some companies may be tempted to prohibit desktop search engines altogether,but that’s not a practical long-term solution. Microsoft will include a desktop search engine as part of its new VISTA operating system, due to be released in 2007. Since most companies upgrade to the newest Microsoft operating system regularly, desktop search engines will soon be commonplace.

That’s why it’s a good idea for companies to consider piloting one or more of the many desktop search engines available from Google, MSN, X1, Yahoo or other providers — and develop policies regarding employee use of the search engines.

Meanwhile, create a policy to prevent employees from downloading computer software without permission. Without that simple step, sensitive data could beleaving the enterprise.