Should we store meeting minutes on an iPad?

Question

Being employed in the infosec field I would like to set a good example. However I also do not believe in sweating the small stuff and would like to maximize my productivity. My current workplace, while piloting byo devices, iPads etc does not yet have an enterprise iPad solution. I have a personal iPad that I would like to use to take minutes of meetings and to brainstorm via mindmaps. At previous places where this was not frowned upon, I have found it significantly better than writing on a physical pad because:

• I can read what I wrote 6 months later and forces me to take clear notes
• I won't lose the data as opposed to old notebooks
• It is a lot easier to copy paste and refer to older information
• It is a lot easier to email rather than typing up notes afterwords
• Using a native mindmap app lets me take better notes and make better assosiations than dooldling on a notepad

These benefits must apply to others also as I have seen other employees in meetings and even senior staff do the same.

On the risk side:

• This is personal rather than corporate device, therefore it is against policy (although one of many that is only enforced when/if there is an incident)
• It is not enterprise managed and the data is not backed up, archived by my company nor can it be deleted by them
• The data and backups maybe stored in the cloud without enterprise acceptable controls and outside their acceptable physical jurisdictions
• There is no guarantee that I will not document confidential information, nor email it via clear text mail
• Capturing information electronically arguably makes it easier to compromise and expose to risk e.g. email

My mitigation's:

• The iPad has a reasonable level of security, it has a complex password, under my physical control, encrypted backups and set to wipe after 10 failed attempts - potentially better than a written notepad which is left on desks etc and potentially better than a corporate laptop without full disk encryption
• With iCloud there are automated encrypted device backups, document sync is still not encrypted as far as I'm aware.
• Intercepting email is arguably the lowest risk associated with email
• The information is only valuable in context, i.e. awareness of the meeting background

So what is the right approach here? Do the benefits outweigh the risk? Or should I as a dutiful automaton follow policy and set a good example and continue to develop my writing and doodling skills and await the enterprise solution (I'm assured coming sometime this century)?

Answer 1

I don't believe the solution is to not use your iPad, the benefits are clear. However I do think you need to approach it the right way.

Working on the InfoSec field, I believe you have a responsibility to set a good example. Eat your own dog food.

You need to comply with policy. Is there an exemption process in the policy? This would be the best way to address this, and allows you to formally document the risks you have identified and the mitigations in your exemption request.

As you've identified, be conscious of the sensitivity of information you are recording and storing. Treat the asset as untrusted, or semi-trusted at best. Consider adopting the attitude where you assume anyone can read what you create or store on the iPad. Recording information out of context, and without granular details can help here.

Finally, promote all of the above. When people ask about your use of your iPad within the organisation for work-related purposes, tell them what you've done to mitigate the risks and comply with policy.

Answer 2

Given that you've outlined the risks and mitigations, isn't it really up to the business to weigh the pros and cons and decide whether its really a good idea to allow the device?

Personally, I'm of the impression that personal devices should be allowed only in certain instances. They should be physically banned from highly sensitive areas of the office if you have such areas, and should never carry any confidential data on them. Otherwise each situation should be considered on a case by case basis.

Part of the solution may be to purchase a dozen iPads for people to request to use.

I doubt there will ever be an Enterprise-grade iPad though.

Answer 3

On a conceptual basis, if there is any problem with your writing minutes on your iPad, the same issues would apply when you use your mobile phone or your home phone to discuss business matters. There is, however, a qualitative difference, security-wise, between your iPad and a notebook: although in both situations, security is under your direct supervision (you are responsible for not forgetting your notebook in a bar, for instance), the notebook requires only physical security, something which human beings are supposed to be good at, since our first ape ancestor found a nifty sharp rock and refused to share it with his colleagues. A notebook cannot be hacked remotely. For the iPad, you rely on a large number of people you do not know (Apple developers, in particular) to be honest and to have done their job properly, not leaving backdoors around (intentionally or not).

In practice, if you use your personal iPad for that job:

• If there is any security issue related to the iPad, you will get publicly flogged. Whereas regular, old-fashion spying on phone lines will not imply such dire consequences. That's the trouble with technology precursors. You cannot be blamed for having used a phone, but you can for having used a non-company-issued iPad.

• Your hierarchy will not like you: by deciding upon yourself that you will use a network-able tool under your sole supervision to store business data, you are bypassing the company policies, and, regardless of whether using an iPad is a good idea or not, bypassing company policies is never well accepted by those who spend their days writing such policies.

• The local system administrator will not like you: your iPad is an intrusion of computer-like hardware which is not under his lordship. This may be viewed as a tentative to dislodge him of his perceived top-ape position.

• Your colleagues will not like you: by showing your willingness to provide your personal iPad for business work, you undermine the potential issuance of iPads by the company to their employees. If you want an iPad in a socially acceptable way, you should beg and whine unless the company grants free iPads for everybody.

• Steve Jobs will like you. But, hey, he's dead.

Also, I cannot help but raise a metaphorical eyebrow at the idea that you "won't lose the data as opposed to old notebooks". Digital information tends to get lost, not only through the obvious hardware failures and where-are-my-backups mishaps, but also due to obsolescence of data formats. What would you do with meeting notes you would have typed on, e.g., a Psion Series 5 a dozen years ago ? Converting text from the file format used by the internal word processor requires some specific hard-to-find software.