Re:Wipeout: When Your Company Kills Your iPhone
by Silhouette on Tuesday November 23, 2010 @06:20PM
(#1935798)
I don't have a black-and-white perspective on risk, but either the data is worth protecting at a remote-wipe kind of level or it's not.
In most cases, the ability to wipe a typical employee's personal phone in response to anything would be a ludicrous over-reaction.
On the other hand, if you have someone who really does need to access sensitive data on their phone, and leaking that data is a $100,000,000 kind of risk, and there is $100,000s of layered security that normally protects that data, then maybe company IT should be authorised to spend $100s on a properly secured device that they can remote wipe if necessary, in preference to giving an obvious attack vector straight past that security.
As you say, it's about the risk. I don't see any circumstances under which risking using an employee's personal phone to access genuinely sensitive data off-network is justified. Either the damage if it leaks is bad, in which case the barrier for providing a company phone is pretty low, or the damage is negligible, in which case requiring a remote wipe facility that can destroy the employee's own property is silly.
In most cases, the ability to wipe a typical employee's personal phone in response to anything would be a ludicrous over-reaction.
On the other hand, if you have someone who really does need to access sensitive data on their phone, and leaking that data is a $100,000,000 kind of risk, and there is $100,000s of layered security that normally protects that data, then maybe company IT should be authorised to spend $100s on a properly secured device that they can remote wipe if necessary, in preference to giving an obvious attack vector straight past that security.
As you say, it's about the risk. I don't see any circumstances under which risking using an employee's personal phone to access genuinely sensitive data off-network is justified. Either the damage if it leaks is bad, in which case the barrier for providing a company phone is pretty low, or the damage is negligible, in which case requiring a remote wipe facility that can destroy the employee's own property is silly.