How to you prevent accidental data/document leakage in a byod world?

Question

As an employee in one of the now endless tech organisations that promote BYOD mobile and laptop devices, or devices in general that can be taken home and or used off premise, how do you prevent accidental data leakage/enforce document destruction in your security policies?

Specific examples of risks I think of are:

• Commerically confidential document is downloaded to device from email, forgotten and backed up by user, later restored to another device/multiple devices and eventually migrates into the users personal documents in the cloud/external hard drive essentially forever lasting. User practices poor cloud security/loses hard drive and document is released into the wild.

• Document A is a policy to follow when doing x,y,z procedures inside the organisation. User A spreads the document to 30 people via email and each user downloads the document. Document A becomes obsolete due to security risk in policy. Document B is released, but users keep using Document A.

I feel as if a security policy alone can not really enforce this behavior as its human error for mis use. Is it unreasonable to make sure documents live in a cloud based environment with correct classification policies and can never be downloaded? e.g utilising a service such as Google Drive or a document management system where you can upload, or edit live but not download.

I feel as if this risk is much less with a traditional client/server setup where essentially the files are owned by the server and the users do not take the devices home. Policies and clean ups on user files are much easier when they all live in a single location. Auditing can occur on things like backing up files to USB etc for malicious use, but I guess i'm more concerned about the accidental side of things.

Thoughts?

Answer 1

Your question is a bit of a jumble but actually asks about a core problem. It's about authorisation.

Who and what is authorised to download/read a document in a cloud world and how do you enforce it?

Policies define a direction and goal. They guide the design of the authorisation process and enforcement mechanisms. In short, they are only a starting point. Ensuring limits on distribution (email, in your example) and version control (policy versions, in your example) need to be enforced through technology.

From a technology perspective, there have been many attempts to address this.

Blackberry and Samsung Knox (full disclosure, I was part of the Knox advisory team) had sandbox areas of the device that could be authorised to connect and allowed the org to control that part of the device. As you probably know, this saw limited success.

But what about BYOD? This, unfortunately, only has a single solution: do not authorise devices to access data that is not under the org's control. Either issue devices to users or ask their consent to install an agent on the device. This is the only way to address this problem in any efficient way.

What about BYOEmail? This is addressed by simply monitoring and auditing emails to webmail addresses. Anything to an employee's personal email account should be barred via policy and followed up on during audits. This addresses your 'accidental' side of things. But, this requires that you maintain your own email systems and have people and mechanisms to perform this level of monitoring.

Yes, BYOD and cloud make it possible for a 5-person team to do the work of a 50-person team, but what's lost in that efficiency is the control over the team's data, and that's what no one talks about. The leap from 'agile' to 'secure' is a big leap ...