2

As an employee in one of the now endless tech organisations that promote BYOD mobile and laptop devices, or devices in general that can be taken home and or used off premise, how do you prevent accidental data leakage/enforce document destruction in your security policies?

Specific examples of risks I think of are:

  • Commerically confidential document is downloaded to device from email, forgotten and backed up by user, later restored to another device/multiple devices and eventually migrates into the users personal documents in the cloud/external hard drive essentially forever lasting. User practices poor cloud security/loses hard drive and document is released into the wild.

  • Document A is a policy to follow when doing x,y,z procedures inside the organisation. User A spreads the document to 30 people via email and each user downloads the document. Document A becomes obsolete due to security risk in policy. Document B is released, but users keep using Document A.

I feel as if a security policy alone can not really enforce this behavior as its human error for mis use. Is it unreasonable to make sure documents live in a cloud based environment with correct classification policies and can never be downloaded? e.g utilising a service such as Google Drive or a document management system where you can upload, or edit live but not download.

I feel as if this risk is much less with a traditional client/server setup where essentially the files are owned by the server and the users do not take the devices home. Policies and clean ups on user files are much easier when they all live in a single location. Auditing can occur on things like backing up files to USB etc for malicious use, but I guess i'm more concerned about the accidental side of things.

Thoughts?

  • policies define the direction and goal, not the protection mechanism - you need technology to address this risk – schroeder Aug 24 '17 at 9:21
  • "can never be downloaded" = "can never be read", which defeats the purpose – schroeder Aug 24 '17 at 9:22
  • have a look at DLP solutions, installing an agent on the devices and tracking the documents based on fingerprints – J.A.K. Aug 24 '17 at 11:16
  • @J.A.K. DLP only works if you control the devices to which the data is accessed. DLP breaks down in BYOD environments – schroeder Aug 24 '17 at 12:05
  • Good point, it would make it harder to circumvent, not impossible. And that would only give the illusion of security. – J.A.K. Aug 24 '17 at 12:19
2

Your question is a bit of a jumble but actually asks about a core problem. It's about authorisation.

Who and what is authorised to download/read a document in a cloud world and how do you enforce it?

Policies define a direction and goal. They guide the design of the authorisation process and enforcement mechanisms. In short, they are only a starting point. Ensuring limits on distribution (email, in your example) and version control (policy versions, in your example) need to be enforced through technology.

From a technology perspective, there have been many attempts to address this.

Blackberry and Samsung Knox (full disclosure, I was part of the Knox advisory team) had sandbox areas of the device that could be authorised to connect and allowed the org to control that part of the device. As you probably know, this saw limited success.

But what about BYOD? This, unfortunately, only has a single solution: do not authorise devices to access data that is not under the org's control. Either issue devices to users or ask their consent to install an agent on the device. This is the only way to address this problem in any efficient way.

What about BYOEmail? This is addressed by simply monitoring and auditing emails to webmail addresses. Anything to an employee's personal email account should be barred via policy and followed up on during audits. This addresses your 'accidental' side of things. But, this requires that you maintain your own email systems and have people and mechanisms to perform this level of monitoring.

Yes, BYOD and cloud make it possible for a 5-person team to do the work of a 50-person team, but what's lost in that efficiency is the control over the team's data, and that's what no one talks about. The leap from 'agile' to 'secure' is a big leap ...

  • Agree completely. I mention policy because my view is that the policy should be somewhere along the lines of not being able to even attach a document to an email, or download a document from the document management system (unless you have a defined role that requires sending externally). You then enforce authorisation, classification, integrity etc. all through the document management software without anyone ever needing a physical copy to view. So essentially email and document management enforce the policy. At the same time this sounds really restrictive and would suffocate staff. – Cyassin Aug 25 '17 at 0:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.