Policy, Program and Procedures

This may seem miniscule… but what are the risks for employees bringing their own colorful keyboards and using them for work purposes?  I'm new to the ISO position here and these new, colorful keyboards seem to be showing up more & more the last couple of months.  Wondering if this is something I should worry about or if I'm over thinking things.  Other IT positions I've held, we never let anyone bring in their own colorful keyboards and now that I'm back in the financial world I have some concerns.  

Does anyone else have thoughts on this?  Need a little guidance if I decide to be the "bad guy" & ask everyone to take their colorful keyboards home. 

Hello Shelly. As long as these are standard USB keyboards, there is no risk. This is more of customization when it comes to peripherals vs any actual risk. The designs and customization appeals more to younger generations.

Not sure what a "colorful" keyboard is. (Beyond the obvious.)

Initial questions, to me, are: What is your company's policy towards the use of personal devices/hardware for work? Has the CISO performed a risk assessment of keyboards generally and set policy? Who has the authority to pair devices (monitors/mice/keyboards etc.) to work issued equipment? 

These are the main, but not necessarily all, risks. 

Perhaps you should discuss with your CISO or Head of IT - whomever has the authority over these issues.

Good luck.

Yes, just the obvious...colorful/pretty keyboards instead of the default black Dell keyboards.  These are all USB keyboards, so nothing to downloads as our users don't have admin creds.  The CISO retired earlier this year & I replaced her as the ISO...so this is my wheelhouse to make a decision on.  We do not allow BYOD for laptops or tablets, but keyboards would be in a different category than a normal BYOD device.  

As a guy in my IT department, there is little risk in this. Our company does order and provide ergonomic keyboards and mice to those who need it, and we have no rules against bringing your own. By themselves, peripherals that can't store information have no risk.

However, we do have a system in place that blocks unauthorized software downloads without IT approval, so if these peripherals come with their own software, then those downloads are blocked. Keyboards and mice typically function just fine without extra software. Perhaps it's very millennial of me, but I see no reason to not let workers have a little joy in their lives if other risk mitigation is in effect.

I tend to agree with the others on low risk for peripherals without storage ability.  However, some do require additional drivers to fully function that you may need to restrict access to. The larger concern could be mechanical keyboards with louder 'clicks'.  Many workplaces have banned these as they're just simply too distracting for other works in close proximity.  I personally use one in my home office and prefer it over a membrane keyboard.  However, I don't think I'd enjoy a coworker in the office using one nearby when I'm trying to concentrate or focus.

Allowing individuals to attach their own peripheral to a company owned device is not permitted in our organization. If you have a special need (ergonomic keyboard, for example), the organization should be providing that. If you like a wireless mouse just because there is no wire, tough, get used to the wired mouse.