CYBEREYE

Mordac is a fool: Just say ‘yes’ to new devices in the enterprise

Sure, you have to keep an eye on new technology, but saying 'no' is a losing battle

We all know Mordac, the Preventer of Information Services in “Dilbert,” the comic strip that documents the lives of cubicle dwellers with such eerie accuracy. He’s the guy who tells you that you can’t have the technology you want.

Mordac is the product of a whitelist mentality that declares no technology can be used in an enterprise that is not managed and/or covered by acceptable use and security policies. This makes perfect sense from a security point of view. Unmanaged and rogue devices introduce significant risks to the enterprise that the IT and security shops cannot mitigate or knowingly accept.

But the end users usually see it only as obstructionism, interfering with their efforts to do their jobs the best they can.

The CIO, CISO or sysadmin who says “no” too often is likely to find himself or herself in a losing battle with workers who will find ways around the prohibitions to use their own tools, said Veterans Affairs Department CIO Roger Baker.


Related coverage:

Are mobile users suckers for phishing attacks?

Are you as safe online as you think you are?


Baker, speaking at a recent cybersecurity conference sponsored by FedScoop, said his job is to say “yes” to workers, enabling the use of new technology.

“The government cannot keep up with the functionality” being introduced in new devices and applications, so the IT shops will always be behind in their policies and management of these tools, he said. “That trend is going to continue.”

The CIO’s job is to find a way to make the new tools work securely in the enterprise, to the extent possible.

The troublesome trend of user-introduced technology began at least as far back as the adoption of the home computer, expanded with the growth of the Internet and availability of laptop PCs, and now is exploding with the increasingly rapid introduction of new personal mobile devices and online applications and services for them.

At least one organization, Unisys, is responding to this challenge by accepting the inevitability of new devices moving into the enterprise.

“It’s quite onerous,” Unisys Chief Information Security Officer Patricia Titus said of the management challenge. “Consumers are driving us in the enterprise to think outside the box,” and the CIO is being forced into a customer-service role in providing services to workers.

But the company is accepting the challenge with pilot programs to allow controlled network access for some consumer devices, including iPhones, and developing acceptable use policies covering the devices and the information they are accessing.

“An acceptable use policy is critical,” Titus said. “It’s like a driver’s license.”

This of course does not mean that enterprises should abandon their perimeters and unquestioningly embrace every piece of hardware and software that comes along.

“‘Yes’ is not an unqualified ‘yes,' ” Baker said.

Although organizations will inevitably be behind consumer adoption in the development of policies and controls for new tools and technologies, when the question of bringing a new tool into the enterprise is raised, administrators should work to see how and whether it can be done securely and efficiently rather than banning it outright.

The alternative is unhappy workers, a failure to take full advantage of technology that might advance the organization’s mission, and the likelihood that the new technology will find its way inside in an unmanaged way.

The task is not always easy, Baker acknowledged. “That’s why we make the big bucks.”

About the Author

William Jackson is freelance writer and the author of the CyberEye blog.

Reader Comments

Mon, Feb 28, 2011

In a government agency, any inefficiency caused by lack of the latest consumer device may cause people to grumble, but one security "incident" caused by an unsecured consumer device will result in people being hung out to dry. That is what Fed. IT personnel are up against. And in a small operation, by the time security and compliance are worked out for, say, an iPhone3, the users have set their sights in an iPhone4...

Mon, Feb 28, 2011

Commercial product changes will always be much, much faster than the ideas of politicians!

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above