User-Centered Security

Bring your own device policies are another area of information technology where security professionals can find their best intentions stymied by users’ attempts to work around policies that don’t consider the user experience first. This came up in conversation with a classmate recently, and there are two primary cases where users circumvent BYOD policies. First, due to a shortage of resources users may not have access to organization-provided mobile devices. Second, users may prefer using their own devices because the organization’s provided devices are old, have an interface the user is unfamiliar with, or are inconvenient to carry or use. The latter case played out in the most recent US Presidential election, with one candidate’s use of her personal IT system rather than the approved government system during her time as Secretary of State becoming a major campaign issue. While most of us don’t need to worry about this level of exposure, either scenario can easily inspire users to...

With the rise of mobile devices in the workplace, many businesses are transitioning from an issued-device, or "here's your device" / "choose your device" model to one that centers on users bringing their own devices: BYOD, or "bring your own device." This model brings many advantages and acts as a great example of information technology policies centered on user experience, but there are important security considerations to keep in mind when integrating these devices into the company IT environment. First, it's critical to communicate clear security policies which will help your users understand what they are agreeing to when they bring their device to work. These policies should govern use of company information, approved uses of the device while connected to company resources, required security measures, user reporting responsibilities, and company authority over device contents in the event of loss, theft, or end of employment. It is especi...