A very earnest man sat and told me how I had to buy a lot of products that would allow me full control of my users in a BYOD environment. When I asked how they were going to do that when the users were connecting to a new 4G network and never used the corporate network he got a bit less confident. He then resorted to my need to assert management "control" to ensure that they did!
The problem is that people have settled into a pattern where they expect the technology to provide the control when in truth it can only do so much. If they can make something happen then it must be okay, mustn't it?
I would argue there are two problems with all the strategies that I have seen to date.
- They are protecting the wrong thing.
- They are ignoring the human factor.
Cisco as a networking company is protecting at the network level; Microsoft as an OS operating system company is protecting at a file level and many other companies protect at the level of their particular historic solution. All of these are the "Answer" to BYOD. None of these solutions consider the information, the value of the data stored that is understood only by those that are working with it.
They ignore the human factor because they assume that the humans will be compliant, but we are not. Worse we generally do not like to be controlled and it takes a lot of effort to do so. As one mechanism for control is put in place a work around will be found to allow us to work in a way that is convenient to us. The more innovative and dynamic the working environment the more quickly the work arounds will appear. So far my experience has shown engineers and students alike are great at this!
So if control will not work, what will?
I believe that we need to work with users of our systems to help them understand the value of the information they are publishing so that they can protect it accordingly. I think we need to encourage them to stop giving responsibility for this to us because we store their data and ensure they know it is actually up to them. Above all they need to understand that we cannot provide a silver bullet to protect them from this. Part of this means that responsibility for data leakage should fall to them not some lowly technologist that failed to encrypt the PC on which they stored it. They should be aware their information should be protected and not store it anywhere that the protection cannot be ensured, wherever that may be.
We for our part need to provide them with the tools they will need to achieve this. In this way we can avoid the stupidity of essential data stored on an encrypted laptop with the password to the laptop written on the lid!