Exactly, it doesn't!
If you have data that is important enough for leakage control at the edge of your network, then it must not be accessible outside of your controlled systems at all.
An employee's personal phone is never a controlled system for the purposes of this policy.
After all, what if the phone isn't stolen, but infected by a data-stealing virus during the employee's personal use?
If companies had the black-and-white perspective on risk you have here, nobody would ever be able to deploy a line of code.
In most cases, the ability to wipe a typical employee's personal phone in response to anything would be a ludicrous over-reaction.
On the other hand, if you have someone who really does need to access sensitive data on their phone, and leaking that data is a $100,000,000 kind of risk, and there is $100,000s of layered security that normally protects that data, then maybe company IT should be authorised to spend $100s on a properly secured device that they can remote wipe if necessary, in preference to giving an obvious attack vector straight past that security.
As you say, it's about the risk. I don't see any circumstances under which risking using an employee's personal phone to access genuinely sensitive data off-network is justified. Either the damage if it leaks is bad, in which case the barrier for providing a company phone is pretty low, or the damage is negligible, in which case requiring a remote wipe facility that can destroy the employee's own property is silly.
I think it's the employees. You know, because it's their phone and in their interest to keep it separate. Did they ask their phone vendor for a phone which could keep the data separate? Did they read the user manual? Did they vote with their feet or dollars? Did they give a damn at all?
> Do you agree that the distinction between personal and company is vague and human defined?
No. The argument made by many people disagreeing with me in this discussion is predicated on the employee downloading data from the company Exchange system. That provides an objective standard for what constitutes "company data".
But if I sync my contacts with a company Exchange server, I cannot add contacts without them being stored on the Exchange server. If I add a personal contact, those details are sent to the company. Is this now personal or company data? How is the Exchange server to know that you don't want contact X deleted? And why should it listen to you if that would just be a way around it's security?
If I open an email with a picture and save it, it goes into the camera roll as a copy. Is that now a personal copy or a company file?
If I get a company email with a link to the corporate intranet and I login, is the cached data in Safari which has corporate data in it but which did not come from the Exchange server, is that company or personal?
If you're going to try to broaden that in some ill-defined way to any other data the employee has, you might as well argue that any employer should have the right to audit any and all of an employee's personal property, communications or brainwaves.
No, that would be stupid.
As I keep saying, if the company requires that kind of control, it should be issuing employees with dedicated systems at company expense, configured appropriately
No it shouldn't. If the company requires work from home it should issue dedicated systems at company expense. If it merely requires control over whatever system you use then it should only provide advice and understanding when you agree to that control.
Just because a company requires control should you wish to access things remotely does not mean that they are obliged to provide the device. Only if they require you to use a device should they provide one. If they do not require it but you choose to provide one, they should be allowed to require restrictions and refuse if you do not agree.
The interesting bit is that these restrictions are
a) not intuitive to a nontechnical person
b) obvious to anyone who knows about them.
I struggle to see any circumstances under which installing software on an employee's personal property that gives the employer the ability to wipe the entire machine arbitrarily would ever be justified.
When that personal property has no other support for erasing important data apart from wiping the entire machine, yet the company mandates that devices be able to erase company data.
What else do you want? You keep switching between:
- Some perfect device which does not exist
- The scenario in the newsitem, where nothing bad happened except the person was shocked and annoyed
- Some hypothetical scenario where extreme damage was done to the person
What are you really arguing? That it's unfair? That it's less than ideal? That the company is horrible? That Microsoft is horrible?
What's your point?
iPhones and other activesync devices cannot but wipe everything or nothing, and companies do demand the ability to wipe data.
Some companies may demand employees buy personal devices for work use, that's unpleasant and possibly illegal. Many do not.
Those that do not often give people the option to use approved personal devices if they prefer them to work provided ones.
If people choose to do that without understanding what they are doing, that is unfortunate. In an ideal world it wouldn't happen, but it does actually happen.
The best thing to do is:
a) Have backups of your important stuff
b) Have a mindset where you can accept things goind weirdly in systems you don't understand.
c) Have a mindset that you accept the more technical and complex the systems involved in your life are, the more this sort of thing is going to happen.
1. If it is the employee's device, then everything belongs to the employee by default.
2. If the employer wants to allow access to certain company facilities or data using that device, then it is the employer's responsibility to ensure that such access complies with any necessary policies, without affecting anything that is none of the company's business.
3. If the employer can not or will not do this, then they should not provide the access in the first place.
4. They always have the option of providing suitable company hardware to the employee with whatever restrictions may be necessary to comply with their policies, at their own expense.
5. Arguments about how the company allowed but didn't require access, the employee consented, etc. are very weak here. Most employees would not be aware of the implications of such policies, and in many workplaces there is a fine line between what is required and what is not required (but if you don't do it we'll penalise/fire you). You're just leaving room for the employer (with its expert system administrators and retained lawyers and heavyweight HR leverage and much greater financial resources) to trample on the employee while wriggling out of any consequences.
> The best thing to do is:
> a) Have backups of your important stuff
> b) Have a mindset where you can accept things goind weirdly in systems you don't understand.
> c) Have a mindset that you accept the more technical and complex the systems involved in your life are, the more this sort of thing is going to happen.
I wonder if you'd feel the same way if, say, your identity was stolen because your home network was compromised by a zero-day exploit in whatever browser you are using to read Hacker News and a data-stealing worm sneaked in. I'm sure you're aware of the theoretical risk of that happening, and you chose to connect to the Internet anyway, so I guess you've accepted the consequences, and anything bad that happens will be your fault rather than the malicious attacker's.
The person who wants the end result gets to agree to the other person's policies.
If your employer wants your device to have email then they get to agree to your policies about your phone. [Edit: except for the big point that this is impossible with current iPhones and Exchange servers].
If you want your phone to have access to your ecompany email then you get to agree to their policies.
I wonder if you'd feel the same way if, say, your identity was stolen because your home network was compromised by a zero-day exploit in whatever browser you are using to read Hacker News and a data-stealing worm sneaked in. I'm sure you're aware of the theoretical risk of that happening, and you chose to connect to the Internet anyway, so I guess you've accepted the consequences, and anything bad that happens will be your fault rather than the malicious attacker's.
My response: Oh shit, now I have to deal with identity theft.
Your response: Let's legislate to forbid providing internet browsers unless the browser provider and ISP can guarantee this can't possibly happen because it's not reasonable for me to audit their code. Let's legislate websites to forbid access unless they can guarantee this can't happen. How could they be allowed to let me on their website without forcing me to consult expert legal advice and have big neon sign warnings about what an accident on their website might do to my computer?!
And in this case, does it sound like the victim made an informed decision that she wanted this end result?
> My response: Oh shit, now I have to deal with identity theft.
I take it you've never actually been on the wrong side of this one, then. I don't believe anyone who has would be so cavalier about it. And yes, I have. It's one of the reasons I'm so adamant in discussions like this that (a) sensitive data must be properly protected, and (b) systems should not be designed so that they can seriously damage an individual without adequate safeguards.
> Your response:
Find perp. Do very unpleasant things to him. Ensure that victim does not suffer any more than necessary due to perp's actions.
Yes, of course. I just think it's the employer's problem in this case, not the employee's.
> Do you agree that the distinction between personal and company is vague and human defined?
No. The argument made by many people disagreeing with me in this discussion is predicated on the employee downloading data from the company Exchange system. That provides an objective standard for what constitutes "company data".
If you're going to try to broaden that in some ill-defined way to any other data the employee has, you might as well argue that any employer should have the right to audit any and all of an employee's personal property, communications or brainwaves. I am aware that some employers actually do seem to think that at least the first two are reasonable, but I vehemently disagree with them, and so does the law in most places.
> What kind of high-end security hardware are you talking about?
The relevant ones here typically record/block/modify network traffic: intrusion detection, data leakage prevention, lawful intercept, that kind of thing.
> If you used an advanced Cisco software VPN client, you could (so I hear) have it scan the client computer and enforce policies on it. If it was used on a personal computer, these would be invasive in a similar way yet you would not blame Cisco or the company if the user didn't understand this, would you?
You mean if
(a) an employee was asked to work from home,
(b) the employee was asked to access the company network using company-provided software installed on their personal computer (the VPN client), and
(c) that software then reformatted the employee's hard drive because someone in corporate IT hit the wrong button by accident,
would I have the same problem with it?
Yes, of course. As I keep saying, if the company requires that kind of control, it should be issuing employees with dedicated systems at company expense, configured appropriately. I struggle to see any circumstances under which installing software on an employee's personal property that gives the employer the ability to wipe the entire machine arbitrarily would ever be justified.