Mordac is a fool: Just say ‘yes’ to new devices in the enterprise
Ensuring the security of new devices brought into the enterprise is a challenge, but if administrators don’t find a way to say “yes” to this technology, they are likely to find themselves in a losing battle with workers, says the Veterans Affairs Department’s CIO, Roger Baker.
We all know Mordac, the Preventer of Information Services in “Dilbert,” the comic strip that documents the lives of cubicle dwellers with such eerie accuracy. He’s the guy who tells you that you can’t have the technology you want.
Mordac is the product of a whitelist mentality that declares no technology can be used in an enterprise that is not managed and/or covered by acceptable use and security policies. This makes perfect sense from a security point of view. Unmanaged and rogue devices introduce significant risks to the enterprise that the IT and security shops cannot mitigate or knowingly accept.
But the end users usually see it only as obstructionism, interfering with their efforts to do their jobs the best they can.
The CIO, CISO or sysadmin who says “no” too often is likely to find himself or herself in a losing battle with workers who will find ways around the prohibitions to use their own tools, said Veterans Affairs Department CIO Roger Baker.
Related coverage:
Are mobile users suckers for phishing attacks?
Are you as safe online as you think you are?
Baker, speaking at a recent cybersecurity conference sponsored by FedScoop, said his job is to say “yes” to workers, enabling the use of new technology.
“The government cannot keep up with the functionality” being introduced in new devices and applications, so the IT shops will always be behind in their policies and management of these tools, he said. “That trend is going to continue.”
The CIO’s job is to find a way to make the new tools work securely in the enterprise, to the extent possible.
The troublesome trend of user-introduced technology began at least as far back as the adoption of the home computer, expanded with the growth of the Internet and availability of laptop PCs, and now is exploding with the increasingly rapid introduction of new personal mobile devices and online applications and services for them.
At least one organization, Unisys, is responding to this challenge by accepting the inevitability of new devices moving into the enterprise.
“It’s quite onerous,” Unisys Chief Information Security Officer Patricia Titus said of the management challenge. “Consumers are driving us in the enterprise to think outside the box,” and the CIO is being forced into a customer-service role in providing services to workers.
But the company is accepting the challenge with pilot programs to allow controlled network access for some consumer devices, including iPhones, and developing acceptable use policies covering the devices and the information they are accessing.
“An acceptable use policy is critical,” Titus said. “It’s like a driver’s license.”
This of course does not mean that enterprises should abandon their perimeters and unquestioningly embrace every piece of hardware and software that comes along.
“‘Yes’ is not an unqualified ‘yes,' ” Baker said.
Although organizations will inevitably be behind consumer adoption in the development of policies and controls for new tools and technologies, when the question of bringing a new tool into the enterprise is raised, administrators should work to see how and whether it can be done securely and efficiently rather than banning it outright.
The alternative is unhappy workers, a failure to take full advantage of technology that might advance the organization’s mission, and the likelihood that the new technology will find its way inside in an unmanaged way.
The task is not always easy, Baker acknowledged. “That’s why we make the big bucks.”