As an employee in one of the now endless tech organisations that promote BYOD mobile and laptop devices, or devices in general that can be taken home and or used off premise, how do you prevent accidental data leakage/enforce document destruction in your security policies?
Specific examples of risks I think of are:
Commerically confidential document is downloaded to device from email, forgotten and backed up by user, later restored to another device/multiple devices and eventually migrates into the users personal documents in the cloud/external hard drive essentially forever lasting. User practices poor cloud security/loses hard drive and document is released into the wild.
Document A is a policy to follow when doing x,y,z procedures inside the organisation. User A spreads the document to 30 people via email and each user downloads the document. Document A becomes obsolete due to security risk in policy. Document B is released, but users keep using Document A.
I feel as if a security policy alone can not really enforce this behavior as its human error for mis use. Is it unreasonable to make sure documents live in a cloud based environment with correct classification policies and can never be downloaded? e.g utilising a service such as Google Drive or a document management system where you can upload, or edit live but not download.
I feel as if this risk is much less with a traditional client/server setup where essentially the files are owned by the server and the users do not take the devices home. Policies and clean ups on user files are much easier when they all live in a single location. Auditing can occur on things like backing up files to USB etc for malicious use, but I guess i'm more concerned about the accidental side of things.