Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Being employed in the infosec field I would like to set a good example. However I also do not believe in sweating the small stuff and would like to maximize my productivity. My current workplace, while piloting byo devices, iPads etc does not yet have an enterprise iPad solution. I have a personal iPad that I would like to use to take minutes of meetings and to brainstorm via mindmaps. At previous places where this was not frowned upon, I have found it significantly better than writing on a physical pad because:

  • I can read what I wrote 6 months later and forces me to take clear notes
  • I won't lose the data as opposed to old notebooks
  • It is a lot easier to copy paste and refer to older information
  • It is a lot easier to email rather than typing up notes afterwords
  • Using a native mindmap app lets me take better notes and make better assosiations than dooldling on a notepad

These benefits must apply to others also as I have seen other employees in meetings and even senior staff do the same.

On the risk side:

  • This is personal rather than corporate device, therefore it is against policy (although one of many that is only enforced when/if there is an incident)
  • It is not enterprise managed and the data is not backed up, archived by my company nor can it be deleted by them
  • The data and backups maybe stored in the cloud without enterprise acceptable controls and outside their acceptable physical jurisdictions
  • There is no guarantee that I will not document confidential information, nor email it via clear text mail
  • Capturing information electronically arguably makes it easier to compromise and expose to risk e.g. email

My mitigation's:

  • The iPad has a reasonable level of security, it has a complex password, under my physical control, encrypted backups and set to wipe after 10 failed attempts - potentially better than a written notepad which is left on desks etc and potentially better than a corporate laptop without full disk encryption
  • With iCloud there are automated encrypted device backups, document sync is still not encrypted as far as I'm aware.
  • Intercepting email is arguably the lowest risk associated with email
  • The information is only valuable in context, i.e. awareness of the meeting background

So what is the right approach here? Do the benefits outweigh the risk? Or should I as a dutiful automaton follow policy and set a good example and continue to develop my writing and doodling skills and await the enterprise solution (I'm assured coming sometime this century)?

share|improve this question

3 Answers 3

up vote 7 down vote accepted

I don't believe the solution is to not use your iPad, the benefits are clear. However I do think you need to approach it the right way.

Working on the InfoSec field, I believe you have a responsibility to set a good example. Eat your own dog food.

You need to comply with policy. Is there an exemption process in the policy? This would be the best way to address this, and allows you to formally document the risks you have identified and the mitigations in your exemption request.

As you've identified, be conscious of the sensitivity of information you are recording and storing. Treat the asset as untrusted, or semi-trusted at best. Consider adopting the attitude where you assume anyone can read what you create or store on the iPad. Recording information out of context, and without granular details can help here.

Finally, promote all of the above. When people ask about your use of your iPad within the organisation for work-related purposes, tell them what you've done to mitigate the risks and comply with policy.

share|improve this answer
    
Thanks that is quite a good answer. Typically it is business users using the exemption process rather than security. –  Rakkhi Oct 31 '11 at 5:27
    
@Rakkhi, do you mean culturally within your organisation? My belief is where the policy applies to all users/staff including ICT/InfoSec personnel, so do the exemption processes. –  lew Oct 31 '11 at 7:06
1  
no its applies to all, just that infosec people are ussually reviewing and rebutting exceptions rather than instigating them. –  Rakkhi Nov 3 '11 at 6:19

On a conceptual basis, if there is any problem with your writing minutes on your iPad, the same issues would apply when you use your mobile phone or your home phone to discuss business matters. There is, however, a qualitative difference, security-wise, between your iPad and a notebook: although in both situations, security is under your direct supervision (you are responsible for not forgetting your notebook in a bar, for instance), the notebook requires only physical security, something which human beings are supposed to be good at, since our first ape ancestor found a nifty sharp rock and refused to share it with his colleagues. A notebook cannot be hacked remotely. For the iPad, you rely on a large number of people you do not know (Apple developers, in particular) to be honest and to have done their job properly, not leaving backdoors around (intentionally or not).

In practice, if you use your personal iPad for that job:

  • If there is any security issue related to the iPad, you will get publicly flogged. Whereas regular, old-fashion spying on phone lines will not imply such dire consequences. That's the trouble with technology precursors. You cannot be blamed for having used a phone, but you can for having used a non-company-issued iPad.

  • Your hierarchy will not like you: by deciding upon yourself that you will use a network-able tool under your sole supervision to store business data, you are bypassing the company policies, and, regardless of whether using an iPad is a good idea or not, bypassing company policies is never well accepted by those who spend their days writing such policies.

  • The local system administrator will not like you: your iPad is an intrusion of computer-like hardware which is not under his lordship. This may be viewed as a tentative to dislodge him of his perceived top-ape position.

  • Your colleagues will not like you: by showing your willingness to provide your personal iPad for business work, you undermine the potential issuance of iPads by the company to their employees. If you want an iPad in a socially acceptable way, you should beg and whine unless the company grants free iPads for everybody.

  • Steve Jobs will like you. But, hey, he's dead.

Also, I cannot help but raise a metaphorical eyebrow at the idea that you "won't lose the data as opposed to old notebooks". Digital information tends to get lost, not only through the obvious hardware failures and where-are-my-backups mishaps, but also due to obsolescence of data formats. What would you do with meeting notes you would have typed on, e.g., a Psion Series 5 a dozen years ago ? Converting text from the file format used by the internal word processor requires some specific hard-to-find software.

share|improve this answer

Given that you've outlined the risks and mitigations, isn't it really up to the business to weigh the pros and cons and decide whether its really a good idea to allow the device?

Personally, I'm of the impression that personal devices should be allowed only in certain instances. They should be physically banned from highly sensitive areas of the office if you have such areas, and should never carry any confidential data on them. Otherwise each situation should be considered on a case by case basis.

Part of the solution may be to purchase a dozen iPads for people to request to use.

I doubt there will ever be an Enterprise-grade iPad though.

share|improve this answer
2  
To expand on what SteveS said, you should outline what would happen if this data ended up being posted all over the internet. If this data wouldn't make sense to anyone, you're probably going to be ok. But would this data getting out hurt you or the company? you also compare the ipad to a notepad, but do you take the ipad home? would you take a work notepad home? does the ipad also have your work email on it? (if it does, that's probably way more interesting than meeting notes...) sounds like this should be a discussion item within your IT and Legal dept. –  Zeb Oct 31 '11 at 1:53
    
I guess that's the difficulty, it has a low likelihood of hurting the company if it is not a targeted attack. If someone had context or stealing it for something specific and can break in then this rises. The written notepad does go home sometimes in my laptop bag so no difference there. iPad does not have work email. –  Rakkhi Oct 31 '11 at 5:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.