3 ms·

Not to mention the inability to enforce full disk encryption and (hopefully) avoid leakage when someone quits. It’s obviously not a silver bullet but at least

by hnarn 3y ago

Not to mention the inability to enforce full disk encryption and (hopefully) avoid leakage when someone quits. It’s obviously not a silver bullet but at least then leakage must be hostile action or incompetence by transferring sensitive data outside of authorized channels.

littlestymaar 3y ago
> the inability to enforce full disk encryption Here's what my previous company did: “please jump on a videoconference call, now please share your screen, and go to the disk encryption settings to show me it's enabled, thank you” You get the same benefit as with stronger enforcement since as you said disk encryption won't protect you from hostile actions anyway.
- hnarn 3y ago
  > You get the same benefit I strongly disagree, because if the employee isn’t handing in their device when they exit that data is still out there. As I said, this is not a silver bullet, but for the data to still “be out there” the employee must at some point transfer the data out of the company device, which should be a policy violation. Also, I honestly personally think a company not providing hardware is a huge red flag, I’ve never encountered it in 15 years (but maybe it’s less common in Europe, I don’t know).
  - littlestymaar 3y ago
    Unless your company provide automatic backup management with straightforward recovery for your employees (which I've never seen, including at customers), your most cautious employees will backup their device in order not to lose their work, and then there's always data “somewhere out there”. Again, the way you deal with employees having company's IP remaining on their computer is to set up a call and ask them to remove it. Good faith employees will do it, bad faith ones would have copied it on their drive before handing out the computer in the first place.
    - hnarn 3y ago
      > Unless your company provide automatic backup management with straightforward recovery for your employees You make this sound like some kind of pipe dream. I don't know what companies you've been at, but for a lot of large corporations today it's completely normal to store all your data in the cloud, from documents at O365 to bespoke SaaS services like gitlab or book-keeping or whatever -- and the ones that don't do it for whatever reasons usually do something very similar, just internally via self-hosting. If every single employee needs to back up their unique snowflake workstation, then something is fundamentally wrong with how data is handled in the first place. > your most cautious employees will backup their device in order not to lose their work The reason employees do this in the first place is because they don't trust the company to ensure the data doesn't disappear. That's the problem right there. I've seen it many times and it's always in chaotic companies filled with shadow IT, which of course are the most vulnerable companies for the same reason.
      - littlestymaar 3y ago
        Of course there's something fundamentally wrong with how the data is handled in the first place at most company big or small, welcome to the real world. BTW the setup you describe with data being replicated in various places without specific coherence is exactly a situation of “there something fundamentally wrong”, and I've yet to see a company where there's a whole-PC backup job running in the background that gives the ability for the IT to give you a clone of your computer on demand in case of loss/failure (and I'm saying a clone of the computer: from the post-it to-do lists, your keybindings/ preferences in software, your bash aliases and small helper scripts, to the customized toolchain you spent three days setting up on five years back and don't remember how to install). Not everyone uses their computer as a mere PowerPoint consumption device… I suppose companies using Mac could do that because that's exactly what time capsule allows you to do but idk if that's easy to deploy company-wide. Anyway, none of what you said justifies to block workers from using their own device (they can and will use the cloud tools you mention with no issue from their computer), and invoking IP protection reasons is just security theater.

by hnarn 3y ago

littlestymaar 3y ago

> the inability to enforce full disk encryption Here's what my previous company did: “please jump on a videoconference call, now please share your screen, and go to the disk encryption settings to show me it's enabled, thank you” You get the same benefit as with stronger enforcement since as you said disk encryption won't protect you from hostile actions anyway.

hnarn 3y ago
> You get the same benefit I strongly disagree, because if the employee isn’t handing in their device when they exit that data is still out there. As I said, this is not a silver bullet, but for the data to still “be out there” the employee must at some point transfer the data out of the company device, which should be a policy violation. Also, I honestly personally think a company not providing hardware is a huge red flag, I’ve never encountered it in 15 years (but maybe it’s less common in Europe, I don’t know).
- littlestymaar 3y ago
  Unless your company provide automatic backup management with straightforward recovery for your employees (which I've never seen, including at customers), your most cautious employees will backup their device in order not to lose their work, and then there's always data “somewhere out there”. Again, the way you deal with employees having company's IP remaining on their computer is to set up a call and ask them to remove it. Good faith employees will do it, bad faith ones would have copied it on their drive before handing out the computer in the first place.
  - hnarn 3y ago
    > Unless your company provide automatic backup management with straightforward recovery for your employees You make this sound like some kind of pipe dream. I don't know what companies you've been at, but for a lot of large corporations today it's completely normal to store all your data in the cloud, from documents at O365 to bespoke SaaS services like gitlab or book-keeping or whatever -- and the ones that don't do it for whatever reasons usually do something very similar, just internally via self-hosting. If every single employee needs to back up their unique snowflake workstation, then something is fundamentally wrong with how data is handled in the first place. > your most cautious employees will backup their device in order not to lose their work The reason employees do this in the first place is because they don't trust the company to ensure the data doesn't disappear. That's the problem right there. I've seen it many times and it's always in chaotic companies filled with shadow IT, which of course are the most vulnerable companies for the same reason.
    - littlestymaar 3y ago
      Of course there's something fundamentally wrong with how the data is handled in the first place at most company big or small, welcome to the real world. BTW the setup you describe with data being replicated in various places without specific coherence is exactly a situation of “there something fundamentally wrong”, and I've yet to see a company where there's a whole-PC backup job running in the background that gives the ability for the IT to give you a clone of your computer on demand in case of loss/failure (and I'm saying a clone of the computer: from the post-it to-do lists, your keybindings/ preferences in software, your bash aliases and small helper scripts, to the customized toolchain you spent three days setting up on five years back and don't remember how to install). Not everyone uses their computer as a mere PowerPoint consumption device… I suppose companies using Mac could do that because that's exactly what time capsule allows you to do but idk if that's easy to deploy company-wide. Anyway, none of what you said justifies to block workers from using their own device (they can and will use the cloud tools you mention with no issue from their computer), and invoking IP protection reasons is just security theater.