Mobile Device Security: Whose Data Is It, Anyway?

Recently, employees at a client organization I work with have been engaged in a fascinating argument, carried out mostly on an internal mailing list. The question is simple: What measures are appropriate for businesses to take to protect corporate data on mobile devices? Although you might think the answer is obvious, there are many interesting nuances that make the best answer hard to determine.

The argument essentially has two sides. The first side (which I'll call "the company line") argues that corporate data is the property of the company. Based on this notion, it follows that the company can, and indeed must, apply protections to keep sensitive data from being misappropriated or lost—a reasonable argument. The other side (which I've dubbed the "live free or die" crowd) argues that it's inappropriate to apply corporate policy controls to personally owned devices. "It's my phone," goes this argument, "so I should be in control of the policies applied to it."

For the most part, I find myself torn between these two arguments. Each position has many good points. In favor of the company line, we have the following:

But the "live free or die" camp has some compelling arguments, too:

As with many other security debates, this one ultimately boils down to a tradeoff between convenience and risk. In organizations where employees buy their own phones, imposing policies can be very unpopular, but it might still be necessary for business reasons. Basic security requirements might dictate that these policies be employed even if their implementation causes extra hassle for end users—after all, most sites use passwords even though they're a hassle sometimes, too.

Ultimately, you should spend some time thinking about the policy approach that makes the most sense for your organization's needs—and that includes your employees' needs, too! If you haven't already deployed mobile devices, this is an ideal time to formulate a policy to avoid unpleasant surprises when you do deploy them. If you already have mobile devices in your environment, you might consider tying policies to device subsidies.

If you've got an innovative approach to dealing with this problem, drop me a line at [email protected]; I'll publish the best solutions in a future column.