Data in the Mobile World

I have been part of multiple discussions with customers lately that center around mobile computing.  The dramatic enhancement to features and functionality we are seeing in the tablet devices, relatively low cost of smart-phones, increases in mobile network speeds and other factors are all contributing to this renewed interest many are expressing in mobility.  The dominant communications method among mobile users is still email, but we are also seeing social capability and functions in every major vendor’s smart phone and tablet.

Freeing the workforce from the physical constraints of an office environment has many benefits.  I am sure we can find case studies on employee satisfaction, productivity, etc that all speak favorably about mobile computing and enabling multiple means of access to corporate data and services.  This freedom, however, cannot sacrifice the security you have developed around your sensitive data.

Increasing demands and restrictions on data security is an ever present concern among security officers in the industry.  They always need to know who is seeing what information, and should they be seeing it.  Mobile devices make it easier for data to be stolen by simply lifting the device or eavesdropping on someone’s screen.  I can’t tell you how many times I have noticed someone in an airport concerning them selves with the goings on of someone else’s laptop close by.

So how do we address this concern?

The answer is not to ignore mobility.  If you try that approach, your users will find ways to work around your security measures and gain whatever level of mobility they can.  This could be far greater of a risk as you will have no governance over the devices or data, nor will your users be educated about handling the responsibility you are now entrusting them with.

The balance of accessibility and security is an age old issue facing IT professionals.  The approach needs to be a strategic and logical one.  I would suggest generating a data security matrix, outlining the disposition of each type of data your organization deals with.  You may already have such a document, but unless it includes a few data points specifically related to mobile access, I would consider it incomplete.

I would setup the matrix to include the following, at least, as an example:

• Data Owner (Who is responsible for the content and access to it?)
• Data Maintainers (Contributors to the content that may not be the owner.)
• Proprietary Yes / No?
• Confidentiality
• Scope of Confidentiality (Individual, Role-Based, Groups, Organization Wide?)
• Regulated Data (What regulations and requirements are put on the data?)
• Penalty of Infraction
• Storage Requirements
• Encryption / Encoding
• Data Expiration / Maintenance Cycle
• Elimination Procedures
• Recovery Procedures
• Scope of Access (On site, Remote, etc.)

As this data matrix is developed, I aim to address as many use cases as possible.  I think about the users and their roles, where they work, the devices they use, and the type of interaction they have with the data.  Paying particular attention to the sensitive and regulated data.  As the use cases become more defined and the sensitivity of the data is established, appropriate procedures for handling the data becomes evident.

I find this logical approach to allowing alternate means of access to enterprise data a very intelligent use of time and resources.  Remaining ahead of user demands in this area often discourages users from finding means of working around the restrictions in place and posing a greater threat than necessary to your organization.

As with almost any security initiative, as most will agree, there is no real substitute for end user training and education.  Empowering your mobile users with the knowledge and tools necessary to keep them selves and your data safe as they roam about the world is another critical component to a comprehensive approach to this demand on your IT organization.

I hope this has given my readers a few useful pointers, or at least opened up the discussion a bit more to help keep everyone safe.  As a leading airline says, “You are free to roam about the country!”

- Happy and Safe Travels!

RE: Social Business

Earlier this week, this article was forwarded to me by a friend on Twitter.

http://www.geniisoft.com/showcase.nsf/archive/20110211-1008

Ben Langhinrichs of Genii Software discusses two elements of responsible social interactions, “The Golden Rule” (treat others the way you want to be treated) and to clean up after your self.  I agree with him that these are important lessons to keep in mind when communicating in the social world, but I want to offer some additional advice on the first lesson in his post.

The first lesson Ben discusses is a no-brainer, and he covers a lot of important points.  I do not think anyone would dispute the fact that “The Golden Rule” should be at least part of the filter used when crafting communications.  In past articles I have written on this topic and when speaking about this in person, I often use the phrase “Don’t put it on the internet if you wouldn’t want your grandmother to know about it.”  While for each of us the figure may not be their grandmother, the point is easily made.  Be respectful in all interactions and you will receive the same in return, typically speaking. 

He also took a moment to emphasize the fact that the internet never forgets.  Thanks to things like Google caching and other syndicating sites that seem to remember everything, you can not simply recant a poor communication.  This leads to many conversations, and while like Ben I don’t intend to point out every example of this gone wrong, I do want to spend a moment discussing how to handle the situation when this does happen.  Obviously, knee-jerk reactions and inflammatory or negative responses can lead to these types of communications that we want to try and avoid.  It is OK to have emotion and charge in your social interactions.  Candid conversations can be some of the most meaningful conversations you have, but can also be dangerous if done without proper thought or discretion.  So should we never have candid conversations??  NO!  Candid and real conversations are very important to making you and/or your organization human and approachable. 

The better way to handle missteps would be to use it as an opportunity to show your character.  Publicly and openly apologize and show how you are correcting your actions.  Make amends with the person/group you offended in the same public forum to show you are able to own up to what you say and do.  The long term benefit of this show of character is without equal.  The chance of avoiding any and all negative or poorly perceived communication all together is not realistic, so the mature thing to do is prepare for the eventuality and have a plan in place ahead of time.  This will go a long way in developing a mature social practice for you and/or your organization.

Social Media Policy

Information Technology solutions have the ability to dramatically improve efficiency, reduce costs, automate complex business operations, and can touch a business in so many positive ways.  Numerous companies and organizations around the globe have realized this years ago and have created IT departments, partnerships, etc.  This is not news.  If you want your IT solution to be successful, there are many factors to consider.  Budget, executive sponsorship, business driver, governance, policy, and enforcement.  Each of these things help bring the solution and the business closer together.  The closer they are the more successful the solution is and the higher the rate of adoption is within the population of people intended to use the solution.  Often, overlooked in this equation is the importance of policy and the consequences for not abiding by this policy.  Not all IT solutions can enforce the participants to follow the rules, and social media can be one of those solutions.

Your social media approach should include both public and private social tools, and since we can not enforce Twitter or Facebook to help us enforce our corporate policies, this becomes a function of the corporate community.  To have the ability to communicate quickly and openly through numerous means as social tools allow us to do so, we do not want to build too many restrictions into the technology it’s self.  I received this posting on Social Fresh from a colleague which is a “starter” Social Computing policy.

http://socialfresh.com/a-template-to-help-start-your-social-media-policy/

For the most part, I feel this is a really strong list of items on which to make decision and build your policy.  I often suggest to clients they use a very simple list of guidelines that summarizes a good deal of these points.  “If you would not say or do it in front of your grandmother, then do not do it in social media.”  This is often well received, and the point is made.  There was one item in this list that I did not feel sent the right message was:

“Each individual should choose for themselves if they will use social media.”

While this is definitely appropriate for a policy on public social media, this should not apply to a private social community.  If you have deployed Connections, Sharepoint, or open source tools to build a private social media outlet, then participation should not really be optional in my opinion.

If, for example, you were to start documenting company policies in a wiki, then reading these policies is not an option.  Users are now using your private social media.  This does not mean they need to contribute, but participate to me includes the act of reading or consuming the information in the social tools.  IBM has given us solutions for capturing metrics and develop trends to observe and drive direction of private social networks.  Often times, this data shows a relatively small percentage of the population that contributes the majority of the information to the social solution, while the largest group of people simply consume this information.  The argument can easily be made, however, that when using technology like tag clouds the tagging of information to classify and elevate an items importance according to how the community sees the item is only as good as the participation it receives. 

Said another way, if you have a company of 100 people, and 80 of them contribute to just the tagging of wiki articles, then the trends of how people group information contained within the wiki will be very relevant and reflective of your community at large.  If the same 100 person company only has 15 people contributing to the tag cloud, I would not assume the tagging of data to be accurately representative of the whole 100 people.

The article makes a really good point, however, and that is if you do not yet have a policy on the use and participation in public social media, you are too late!  I would venture to guess that more than half of professional people use some social outlet to communicate with at least friends and family.  If you have not set peoples expectations on what you feel is acceptable or not in these public forums then individuals can rightfully assume anything is appropriate.  Ignoring the importance of social media in your business strategies and market message is irresponsible and narrow sighted in my opinion at this point.  Since 2008, people have been saying social media is mainstreamed, and in 2010 we saw marketing through social media reach numbers of participants that would indicate mainstreaming as well. 

My advice, in closing, is do not dismiss social media any longer.  Make policy, educate your workforce, and include the use of these tools in your working environment.  The good that they bring far out-weigh the potential risks, and when proper policy is enforced around the use of these outlets, the results will be profound.  Look at what Ed Brill has done for Lotus with just a blog!