Being employed in the infosec field I would like to set a good example. However I also do not believe in sweating the small stuff and would like to maximize my productivity. My current workplace, while piloting byo devices, iPads etc does not yet have an enterprise iPad solution. I have a personal iPad that I would like to use to take minutes of meetings and to brainstorm via mindmaps. At previous places where this was not frowned upon, I have found it significantly better than writing on a physical pad because:
- I can read what I wrote 6 months later and forces me to take clear notes
- I won't lose the data as opposed to old notebooks
- It is a lot easier to copy paste and refer to older information
- It is a lot easier to email rather than typing up notes afterwords
- Using a native mindmap app lets me take better notes and make better assosiations than dooldling on a notepad
These benefits must apply to others also as I have seen other employees in meetings and even senior staff do the same.
On the risk side:
- This is personal rather than corporate device, therefore it is against policy (although one of many that is only enforced when/if there is an incident)
- It is not enterprise managed and the data is not backed up, archived by my company nor can it be deleted by them
- The data and backups maybe stored in the cloud without enterprise acceptable controls and outside their acceptable physical jurisdictions
- There is no guarantee that I will not document confidential information, nor email it via clear text mail
- Capturing information electronically arguably makes it easier to compromise and expose to risk e.g. email
- The iPad has a reasonable level of security, it has a complex password, under my physical control, encrypted backups and set to wipe after 10 failed attempts - potentially better than a written notepad which is left on desks etc and potentially better than a corporate laptop without full disk encryption
- With iCloud there are automated encrypted device backups, document sync is still not encrypted as far as I'm aware.
- Intercepting email is arguably the lowest risk associated with email
- The information is only valuable in context, i.e. awareness of the meeting background
So what is the right approach here? Do the benefits outweigh the risk? Or should I as a dutiful automaton follow policy and set a good example and continue to develop my writing and doodling skills and await the enterprise solution (I'm assured coming sometime this century)?